Android Threat ‘Hirudo’ Hijacks Banking Apps to Slip Past Security Measures

A new strain of Android malware dubbed Hirudo has been observed swapping out genuine banking applications with altered copies that mute built‑in security checks, allowing cybercriminals to capture users' login credentials and potentially drain accounts.

Security analysts say Hirudo operates by extracting the original banking app package, injecting malicious code that disables features such as two‑factor authentication and biometric verification, and then repackaging the app under the same name and icon. The compromised version is then installed on the victim’s device, often without the user noticing any visual difference.

The technique arrives at a time when mobile banking accounts for a growing share of financial transactions worldwide, and Android dominates the global smartphone market. Attackers have long targeted the platform because its openness makes it easier to distribute tampered applications through unofficial stores, side‑loading, or malicious advertising networks.

The malware was first detailed by security outlet BleepingComputer, which cited researchers that uncovered Hirudo circulating via third‑party app marketplaces and deceptive download prompts. Because the malicious package mimics a legitimate app’s signature and name, automated scanners such as Google Play Protect may initially overlook it, giving the code a window to harvest credentials before detection.

Experts warn that the consequences for unsuspecting users can be severe, ranging from unauthorized transfers to identity theft. Financial institutions typically rely on multi‑factor authentication to block illicit access, but Hirudo’s ability to neutralize those safeguards undermines that defensive layer.

In response, several banks have issued advisories urging customers to reinstall their apps exclusively from official app stores, verify digital signatures, and monitor account activity closely. Google has reportedly begun flagging the offending packages and is working to purge them from its ecosystem, while also tightening review processes for apps that request high‑risk permissions.

The emergence of Hirudo underscores the need for stronger vetting mechanisms, both at the platform level and within the banking sector, as well as heightened user awareness about the dangers of sideloading apps. Regulators may also look to impose stricter disclosure requirements for mobile‑banking security, aiming to curb the spread of similar threats in the future.