Hirudo Android Banking Trojan Uninstalls Legitimate Bank Apps and Installs Attacker-Controlled Fakes
Researchers at ThreatFabric have published a detailed analysis of Hirudo, an Android banking trojan that doubles as a remote access tool and stealthily replaces legitimate bank applications with attacker-controlled copies.
The infection begins with lure applications themed around shopping, adult video content, and short video series. The identified decoys include Shopora, 1V1 X, ZoyaTV, and KoiShort. These apps first check whether Hirudo is already present on the device; if it is not, they display a fake update notification that leads the user to install a second package containing the trojan.
Once active, Hirudo leverages the accessibility service to monitor the device. Upon detecting a targeted banking application, it verifies the app’s signing certificate, presents a fraudulent update message, and opens the system uninstaller for the genuine app. Because Android refuses to treat the malicious copy as an update of an app signed by the bank, the original must be removed first. Users can interrupt the attack at this stage by cancelling the uninstallation or refusing the subsequent installation.
The replacement application carries the same package name and version number but is signed with a publicly known test key. After installation, an interception engine built on the open-source projects YAHFA and Dobby performs several evasion and bypass functions: it returns the bank’s legitimate certificate when the app queries its own signature, reports an empty list of accessibility services, removes the flag that prevents screen capture, and forwards selected Play Integrity checks to the operator’s command-and-control server.
The current toolkit contains eight pre-built replicas aimed at seven banks in Indonesia. Credential-harvesting operations target users in China, India, Mexico, Morocco, and Thailand. No infections have been reported in Brazil, and the fake payment overlay displays branding from a Malaysian bank.
Server records obtained by ThreatFabric in August 2026 contained thousands of stolen credentials, device identifiers, and financial profiles. The company notes that the attestation key set used in the scheme was publicly leaked and that at least two certificates from the set appear on Google’s revocation list.
Related articles
Over 300 Tor Exit Nodes Hijacked to Intercept SSH Passwords and Deploy Ebury Backdoor
Attackers compromised hundreds of Tor exit nodes and repurposed them to perform man-in-the-middle attacks against SSH connections. Instead of reaching the intended server, users were redirected to attacker-controlled infrastructure where they could be tricked into accepting a forged host key and revealing their credentials. Researcher kaba identified 333 malicious exit nodes routing traffic through the same 12 interception servers after noticing an unexpected host-key warning on October 2. The campaign also attempted to install the Ebury Linux backdoor designed to steal authentication data. The Tor Project confirmed that operators' servers had their configurations altered and some middle relays were converted into exit nodes. The initial access vector remains unknown, but the activity window was limited to October 1-5. Users who connected via Tor during this period, accepted an unfamiliar key, and entered a password should treat their credentials as compromised.
LunaSpy Android Spyware Masquerades as FSB Antivirus and Bundles Right Dialer
Positive Technologies researchers discovered a malicious APK named Антивирус ФСБ.apk that installs the legitimate Right Dialer application from developer Goodwy while embedding the LunaSpy spyware. The sample uses package name com.syscore.toolsuite and requests extensive permissions including Accessibility Service to enable broad device control. Dynamic analysis in PT Sandbox revealed command-and-control communication, privilege escalation, and creation of hidden files. Static analysis showed XOR-encrypted strings and an expanded command set that includes call recording via CallService, call redirection rules in JSON format, screen tree extraction, gesture simulation, and anti-analysis commands such as RESET_REBOOT and DISABLE_PLAY_PROTECT. The malware can exfiltrate call recordings in WAV format, perform taps and swipes, and revive camera and microphone permissions through overlay notifications. Researchers published file and network indicators of compromise including multiple IP addresses used by the operators.
MegaFon Reports 34% Rise in Russian Mobile Malware Infections Driven by Android Trojans
MegaFon monitoring data shows a 34% year-over-year increase in Russian users with detected mobile malware during summer 2026, with the sharpest spike of 77% recorded in August. The growth is primarily attributed to Android trojans capable of installing apps without user consent, intercepting notifications, enabling remote access, and stealing personal data. At the same time, blocked suspicious calls dropped significantly, by 31% in June, 41% in July, and 75% in August, which the operator links to state and corporate anti-fraud measures. Scammers are adapting by hijacking messenger accounts through social engineering, malware, and even rental schemes, often combining calls with fake app installations that deploy spyware. Phishing remains active, with 30% of detected malicious resources tied to investments and crypto, 21% to social networks and messengers, and 9% to harmful APK files. Director Sergey Khrenov noted that smartphones are increasingly used as tools by the attackers themselves in these hybrid schemes.
Reflective DLL Injection: How Malware Executes DLLs Directly in Memory Without Disk Files
Reflective DLL Injection allows malicious code to load and execute a DLL entirely in memory, bypassing traditional file-based loading mechanisms on Windows. The technique uses a custom loader inside the DLL itself to handle PE format parsing, relocations, imports, TLS, and exception handling without calling LoadLibrary. Unlike standard loading, the resulting module often resides in MEM_PRIVATE regions and does not appear in conventional module lists, complicating forensic analysis. Tools such as Meterpreter and Cobalt Strike have historically employed reflective loaders, though Beacon Object Files represent a different COFF-based approach. Investigators must examine memory regions, thread start addresses, and Sysmon events 7, 8, and 10 rather than relying solely on file artifacts. The method does not bypass DEP, Arbitrary Code Guard, or access-control restrictions and leaves detectable traces when combined with behavioral indicators. Proper detection requires correlating private executable memory with process behavior and avoiding over-reliance on simplified signatures.