Brief
New Android trojan Hirudo replaces banking apps to steal credentials
The Hirudo trojan disguises itself as a legitimate update, hijacks banking apps and intercepts OTPs, posing a fresh threat to mobile banking users.
By Felo News Desk · Published
Security researchers have identified a new Android banking trojan called Hirudo that removes genuine banking applications and replaces them with near‑identical counterfeit versions to harvest credentials, according to Gulf News.
What happened
The infection typically starts when users click on seemingly innocuous online ads on platforms such as Facebook or Instagram. The ads promote free streaming, shopping or entertainment services and direct users to a website that mimics the Google Play Store. After installing the advertised app, users are prompted to apply an "update" that actually installs a second malicious package. Once installed, Hirudo requests elevated permissions, including Accessibility Services and Notification Access, allowing it to monitor screen activity, read notifications and capture one‑time passwords (OTPs). The malware then uninstalls the legitimate banking app and replaces it with a counterfeit copy that looks identical to the original, enabling the theft of login details and transaction codes.
What the reports add
Gulf News notes that unlike earlier banking malware that merely overlays fake login screens, Hirudo actively removes the real app before installing the fake version. The outlet also highlights that the malware’s name derives from the Latin word for "leech," reflecting its stealthy attachment to victims' devices. The article describes the social‑media ad vector and the use of a fake Google Play‑like site as a key part of the infection chain.
What was said
Anoop Paudval, Head of Information Security Governance, Risk, and Compliance (GRC) for Gulf News, explained that the discovery "highlights a disturbing evolution in mobile banking threats" and warned that cybercriminals are becoming more sophisticated. Banking‑industry expert Dhiraj Sasidharan, quoted in the piece, described the malware as a "new breed of banking attack" that can intercept security codes and monitor user activity.
How it came about
The report follows earlier Felo News coverage on mobile‑banking security, including a guide on updating a bank‑linked mobile number without visiting a branch (published 2026‑10‑02). Both pieces underscore the growing need for users to verify app sources and manage permissions carefully.
Key facts
- Hirudo is an Android trojan that removes genuine banking apps and installs counterfeit copies. (gulfnews.com)
- The infection often begins via ads on Facebook or Instagram that lead to a fake Google Play Store site. (gulfnews.com)
- The malware requests Accessibility Services and Notification Access to capture OTPs and monitor activity. (gulfnews.com)
- Anoop Paudval of Gulf News called the discovery a "disturbing evolution in mobile banking threats." (gulfnews.com)
- Dhiraj Sasidharan described Hirudo as a "new breed of banking attack." (gulfnews.com)
Sources
- [1] gulfnews.com — originally reported as “The leech that wears your bank’s face: New Android trojan raises alarm for millions of mobile banking users”
