Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
ThreatFabric's Mobile Threat Intelligence team has identified a new Android banking remote access trojan we track as Hirudo. Hirudo combines on-device credential theft with live remote control of the same phone, and it is delivered by shopping and entertainment apps that carry the trojan as a separate installation package. On their own, those traits place Hirudo alongside the current generation of Accessibility-driven Android bankers. What sets it apart is the lengths its operators go to once a bank is in their sights: rather than overlaying a fake screen on top of the genuine banking app, Hirudo attempts to replace the banking app itself with a modified copy that quietly disables the bank's own security checks from the inside.
In this article we focus on four things: how the banking apps are patched, how the campaign is distributed, who it targets, and the fraud it is built to commit.
Article Link: Hirudo: From Fake Updates to Patched Banking Apps