A novel RAT uses trojanized replacements of legitimate banking apps to neutralize security controls from inside itself.
Hirudo is a remote access banking trojan for Android that combines elements of a traditional banking trojan and a full-featured RAT: it includes on-device credential theft with live remote control of the same phone. Remote control provides live screen viewing via WebRTC, remote camera access, and remote interaction through Android Accessibility Services.
The malware, tracked and analyzed by ThreatFabric, is delivered via a dropper contained within genuine-looking downloaded content (a shopping app, an adult video app or a short drama app advertised via social media). Victims install what appears to be a legitimate application, but once installed, the contained dropper checks whether the Hirudo RAT is already present and installs it if not.
The Hirudo payload currently targets eight Indonesian banking apps. Internal code suggests it could also be used to target banks in China, India, Mexico, Morocco and Thailand. The malware detects the specific Indonesian banking app in use on the device, displays a fake update prompt and proceeds to uninstall the true app and download its own modified bank-specific replacement.
This modified version of the app includes a hooking engine to blind signature, Accessibility, screen-capture and Play Integrity checks from within the app. “When the app asks Android for its signing certificate, the hook substitutes the genuine certificate and hides the test-key signature. When it queries enabled Accessibility services, the hook returns an empty list, so the controlling service is invisible,” comment the researchers.
The Hirudo RAT will steal banking credentials, gain real-time remote control of victim devices, provide live screen viewing of front- and rear-camera sessions, and SMS collection, including a 90-day initial scan and a configured list of bank and wallet senders.
The significance, say the researchers, is that “Hirudo marks a deliberate escalation in how Android bankers approach hardened applications. By moving its tampering inside the target app, the operation shifts the contest from the device to the application’s own integrity checks, and from a bespoke patch to a reusable engine that can be retargeted at other apps and regions.” Signals produced locally by an app which may have been replaced cannot be trusted on their own.
ThreatFabric offers fourfold advice to financial institutions. Play integrity should be verified and enforced server side. A valid verdict on its own is not enough since Hirudo relays Integrity requests through its own server.
Layered defenses with additional behavioral analytics should be applied. Behavioral data can help spot fraudulent activity, while the lack of behavioral data would be suspicious in itself.
Accessibility and screen-capture signals should be treated as supporting evidence rather than blocking evidence since fake apps can hide their own Accessibility service. Checks should feed risk scoring rather than stand on their own.
Backend transaction-risk controls at login, credential recovery, beneficiary creation and payment approval should be retained. A forged local result cannot substitute for a server-side decision.
Related: RatHat Android Trojan Uses AI for Automation
Related: XWorm RAT Evolves Into Surveillance Platform
Related: Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks
Related: New ‘Mistic’ RAT Opens Door to Several Ransomware Families
