Android Trojan “Hirudo” Replaces Banking Apps to Evade Security Measures

Security researchers have uncovered a fresh Android menace called “Hirudo” that bypasses conventional safeguards by covertly swapping authentic banking apps with counterfeit versions that siphon login credentials.

The trojan first scans the device for a banking application, removes the genuine program, and then installs a modified duplicate. Although the fake app looks exactly like the real one, it disables native protections—including certificate pinning and biometric checks—so it can record usernames, passwords and one‑time codes and transmit them to the attackers’ remote servers.

BleepingComputer first reported the finding after analysts reverse‑engineered a specimen that had spread via phishing URLs and third‑party app marketplaces. The code contains a routine that watches for installed banking packages, initiates the swap, and subsequently wipes its own footprints to stay hidden from typical anti‑malware tools.

Should the trojan achieve wide distribution, banks may experience a spike in fraudulent activity. By disabling usual safeguards such as two‑factor authentication and app‑level encryption, Hirudo enables perpetrators to maintain ongoing access to accounts without triggering immediate alerts. This risk is especially worrisome for users who depend on mobile banking as their main transaction method.