Security researchers at ThreatFabric have discovered the Android malware Hirudo, which replaces installed banking apps with tampered versions and siphons off data in the process. As chip.de reports, the researchers have so far found copies of eight banking applications.
According to the report, Hirudo disguises itself as a shopping, entertainment or short-video app and requests access permissions under a pretext, including accessibility services. The malware then removes the original banking app, downloads a modified version and installs it. According to ThreatFabric, an integrated hooking mechanism can bypass signature checks, accessibility controls and Play Integrity queries, among other things. The tampered app looks largely like the original.
At the same time, according to ThreatFabric, attackers can capture banking passwords, payment and device PINs, SMS messages and screen contents; the camera and microphone could also be misused. Fake payment pages displayed a successful completion after data was entered.
ThreatFabric first observed Hirudo in banking apps from Indonesia. There are also indications of attacks against financial organisations in China, India, Mexico, Morocco and Thailand. The number of those affected is so far unknown, but is said to be in the thousands.
Android users should install apps only from official sources, not open APK files from unknown stores, keep devices up to date and run Play Protect regularly. If malware is suspected, the Federal Office for Information Security (BSI) advises, according to chip.de, first checking recently installed apps and deleting them immediately.
