Overview
- ThreatFabric publicly disclosed its analysis on Wednesday and Thursday, Oct. 14–15, showing trojanized replacements for eight Indonesian banking apps and code that can target banks in other countries.
- The malware uninstalls genuine bank apps and installs near‑identical patched copies that load a hooking engine built on YAHFA and Dobby to falsify signing certificates, hide Accessibility services, and remove screenshot protections.
- Hirudo couples credential theft with full remote access by collecting SMS, streaming the screen and cameras, and allowing live remote control of infected devices.
- Operators deliver the RAT through convincing dropper apps and ad-driven landing pages served from CloudFront and tracked by OpenInstall and Meta pixels, and ThreatFabric found an exposed APK-processing backend with thousands of credential and device records from August 2026.
- Defenders have limited detection routes because the operation shipped a leaked attestation keybox that Google flagged, so banks should treat local app signals as attacker-influenced and enforce server-side attestation, behavioral analytics, and backend transaction controls while users avoid side‑loading and keep devices updated.