Hackers Use Fake App Updates to Replace Legitimate Banking Apps With Malicious Versions

Hirudo — Android bank tizimiga masofadan kirish troyan (RAT) bo‘lib, u hisob ma’lumotlarini o‘g‘irlashi va zararlangan telefonni masofadan boshqarishi mumkin.

Uning eng g‘ayrioddiy xususiyati — tanlangan haqiqiy bank ilovalarini o‘zgartirilgan nusxalar bilan almashtirish qobiliyati bo‘lib, bu nusxalar ilova ichidan xavfsizlik tekshiruvlariga aralashish uchun mo‘ljallangan.

Hirudo ikki ilovali tizimdan foydalanadi. Jabrlanuvchilar avval ishonchli savdo yoki ko‘ngilochar ilovani o‘rnatadilar, jumladan Shopora, 1V1 X, ZoyaTV yoki KoiShort brendli jalb qiluvchi ilovalarni.

Bu ilovalar haqiqiy yoki ishonchli ko‘rinadigan kontentni ko‘rsatadi, lekin shuningdek, tushiruvchi (dropper) vazifasini ham bajaradi: agar alohida Hirudo yuklamasi hali o‘rnatilmagan bo‘lsa, jalb qiluvchi ilova soxta ilova ichidagi yangilanishni ko‘rsatib, foydalanuvchini uni o‘rnatishga undaydi.

Yuklama keyin o‘g‘irlik va masofadan boshqarish funksiyalarini ta’minlaydigan ruxsatlarni so‘raydi, jumladan Accessibility (foydalanish qulayligi) va bildirishnomalarga kirish ruxsatlarini.

Bu ruxsatlar bilan operatorlar bank hisob ma’lumotlarini, to‘lov PIN-kodlarini, qurilmani ochish sirlarini va SMS xabarlarini to‘plashlari, shuningdek, WebRTC orqali ekranni ko‘rishlari va telefon kameralarga kirishlari mumkin.

Hirudo 42 ta moliyaviy ilova ro‘yxatini saqlaydi, lekin ThreatFabric yetti bank bo‘yicha sakkizta indoneziyalik bank ilovasi uchun maxsus almashtirish paketlarini topdi.

Qo‘llab-quvvatlanadigan ilova aniqlanganda, RAT yana bir soxta yangilanish so‘rovini ko‘rsatadi, haqiqiy ilova uchun Android o‘chiruvchini ochadi va o‘zgartirilgan versiyani yuklab oladi.

ThreatFabric tadqiqotchilari aytishicha, Hirudo shuningdek, jalb qiluvchi ilova ustida shaffof soxta to‘lov sahifasini ko‘rsatishi, to‘lov PIN-kodini ushlashi va soxta muvaffaqiyat xabarini qaytarib, operatsiyani haqiqiydek ko‘rsatishi mumkin.

Bank ilovalarini o‘g‘irlash

Almashtirish bank ilovasining paket nomi va versiyasini saqlab qoladi, lekin ochiq Android test kalitidan foydalanadi, shuning uchun u bank imzolagan asl ilova ustiga oddiy yangilanish sifatida o‘rnatilmaydi. Avval haqiqiy ilova o‘chirilishi kerak.

O‘zgartirilgan ilova bank kodining ko‘p qismini saqlab qoladi, lekin ochiq manbali YAHFA va Dobby tizimlari asosida qurilgan hooking (aralashish) dvigatelini yuklaydigan boshlang‘ich ko‘rsatmani qo‘shadi.

Faollashtirilgach, dvigatel ilovaning o‘z imzolash sertifikati haqidagi ko‘rinishini soxtalashtirishi, yoqilgan Android Accessibility xizmatlarini yashirishi, FLAG_SECURE ekran suratga olish cheklovini olib tashlashi va kalit attestatsiyasi hamda Play Integrity tekshiruvlarini buzishi mumkin.

Aslida, odatda buzilgan muhitni aniqlashga yordam beradigan tekshiruvlar hujumchi nazoratidagi natijalarni qaytarishi mumkin.

ThreatFabric muhim cheklovlarni ta’kidlaydi: almashtirish jarayoni jabrlanuvchining asl ilovani o‘chirishga va yangi paketni o‘rnatishga ruxsat berishiga bog‘liq, bu qadamlar to‘xtatilishi mumkin.

Tadqiqotchilar shuningdek, biriktirilgan attestatsiya kalit qutisi (keybox) ommaviy ravishda sizdirilganini, kamida ikkita sertifikat Google’ning bekor qilish ro‘yxatida paydo bo‘lganini aniqladilar. Shuning uchun server tomonidagi bekor qilish tekshiruvlari bu soxtalashtirishlarni aniqlashga yordam berishi mumkin.

Operatorning APK qayta ishlash paneli, autentifikatsiyasiz kirish mumkin, shell va yuklama APK’larini jalb qiluvchi va o‘zgartirilgan bank ilovalariga qayta quradi (Manba: ThreatFabric).

Jalb qiluvchilar Amazon CloudFront orqali tarqatiladi, kampaniya kuzatuvi OpenInstall atributsiyasi va Meta Pixel identifikatorlari bilan bog‘langan.

ThreatFabric shuningdek, jalb qiluvchi va almashtirish ilovalarini yig‘ish uchun ishlatiladigan ochiq APK qayta ishlash panelini topdi. Ba’zi yuklab olish yo‘llari 2026-yil sentyabr va oktyabr oylarida ham faol bo‘lgan.

Reklama va atributsiya oqimi mavzusidagi jalb qiluvchi ilovalar, CloudFront orqali yetkaziladi va operator tomonidan boshqariladigan APK paneli orqali qayta quriladi (Manba: ThreatFabric).

Bu topilmalar tanish reklama va bulutli yetkazib berish infratuzilmasi zararli dastur tarqatilishini faqat shubhali yuklab olish saytlariga tayanmasdan qo‘llab-quvvatlashi mumkinligini ko‘rsatadi.

Ma’lum bank ilovalarini almashtirishlar Indoneziya bilan bog‘liq, lekin Hirudo kodida Xitoy, Hindiston, Meksika, Marokash va Tailandda hisob ma’lumotlari maqsadlari nomlangan.

Uning soxta to‘lov sahifasi shuningdek, Malayziya bank va hamyon brendlarini o‘z ichiga oladi. ThreatFabric 2026-yil avgust oyida olingan orqa fon ma’lumotlarida minglab hisob ma’lumotlari va qurilma yozuvlari, shuningdek, ekran qulf tarixi va moliyaviy profil maydonlari borligini ham xabar qildi.

Hirudo banklar ilovaning mahalliy xavfsizlik signallarini yakuniy deb qabul qilmasligi kerakligini ko‘rsatadi: almashtirilgan ilova o‘z yaxlitligi haqida xabar beradigan narsalarni manipulyatsiya qilishi mumkin.

ThreatFabric Play Integrity’ni server tomonida tekshirishni, hukmlarni sessiyalar va himoyalangan harakatlarga bog‘lashni, attestatsiya bekor qilishini tekshirishni va kirish, foyda oluvchi o‘zgartirishlari va to‘lovlar uchun tranzaksiya xavf nazoratini saqlab qolishni tavsiya qiladi.

Accessibility va ekran suratga olish ko‘rsatkichlari foydali bo‘lib qoladi, lekin ular yakka-yakka himoya sifatida emas, balki kengroq xavf baholashini qo‘llab-quvvatlashi kerak.

Android foydalanuvchilari uchun kampaniyaning asosiy ogohlantirishi amaliy: savdo yoki ko‘ngilochar ilova ichidagi yangilanish so‘rovi ikkinchi, bog‘liq bo‘lmagan o‘rnatishga olib kelishi mumkin.

Ishonchli ilova do‘konlaridan tashqarida APK’larni o‘rnatish so‘rovlariga ehtiyotkorlik bilan yondashing, ayniqsa ular Accessibility kirishini so‘rasa yoki bank ilovasini o‘chirishni so‘rasa.

Agar bank ilovasi kutilmaganda yo‘qolsa yoki almashtirilsa, tizimga kirmang va bank bilan tasdiqlangan kanal orqali bog‘laning.

IOC’lar

Eslatma: IP manzillar va domenlar tasodifiy hal qilish yoki giperhavola qilishning oldini olish uchun ataylab buzib ko‘rsatilgan (masalan, [.]). Faqat nazorat qilinadigan tahdid razvedka platformalarida, masalan MISP, VirusTotal yoki SIEM tizimingizda qayta tiklang.

Hirudo, an Android banking remote-access trojan (RAT) that can steal credentials and remotely control an infected phone.

Its most unusual feature is the ability to replace selected genuine banking apps with modified copies designed to interfere with security checks from inside the app itself.

Hirudo uses a two-app setup. Victims first install a convincing shopping or entertainment app, including lures branded Shopora, 1V1 X, ZoyaTV or KoiShort.

These apps display real or plausible content but also act as droppers: when the separate Hirudo payload isn’t already installed, the lure shows a fake in-app update that prompts the user to install it.

The payload then seeks permissions that enable its theft and remote-control functions, including Accessibility access and notification access.

With those permissions, operators can collect banking credentials, payment PINs, device-unlock secrets and SMS messages, as well as view the screen over WebRTC and access the phone’s cameras.

Hirudo maintains a registry of 42 financial apps, but ThreatFabric found dedicated replacement packages for eight Indonesian banking apps across seven banks.

The Hirudo fraud chain (Source : ThreatFabric).

When it detects a supported app, the RAT presents another fake update prompt, opens Android’s uninstaller for the genuine app and downloads a modified version.

ThreatFabric Researchers said that, Hirudo can also display a transparent fake checkout over a lure app, capture a payment PIN and return a forged success message to make the transaction appear legitimate.

Banking App Hijacking

The replacement retains the bank app’s package name and version but uses a public Android test key, so it cannot be installed as a normal update over the bank-signed original. The genuine app must first be removed.

The modified app leaves most bank code intact but adds a startup instruction that loads a hooking engine built on the open-source YAHFA and Dobby frameworks.

Once activated, the engine can falsify the app’s view of its signing certificate, hide enabled Android Accessibility services, remove the FLAG_SECURE screen-capture restriction and tamper with key-attestation and Play Integrity checks.

In effect, checks that would ordinarily help identify a compromised environment can be made to return attacker-controlled results.

ThreatFabric notes important limits: the replacement process depends on the victim allowing the original app to be uninstalled and the new package to be installed, steps that can be interrupted.

Researchers also found that a bundled attestation keybox was publicly leaked, with at least two certificates appearing on Google’s revocation list. Server-side revocation checks can therefore help identify these forgeries.

The operator’s APK-processing panel, reachable without authentication, rebuilds shell and payload APKs into lures and patched banking apps (Source : ThreatFabric).

The lures are distributed through Amazon CloudFront, with campaign tracking linked to OpenInstall attribution and Meta Pixel identifiers.

ThreatFabric also found an exposed APK-processing panel used to assemble lure and replacement apps. Some download routes remained live in September and October 2026.

A dvertising and attribution feed themed lure apps, delivered via CloudFront and rebuilt by an operator-run APK panel (Source : ThreatFabric).

These findings show how familiar advertising and cloud-delivery infrastructure can support malware distribution without relying solely on obviously suspicious download sites.

Indonesia is the focus of the known bank-app replacements, but Hirudo’s code names credential targets in China, India, Mexico, Morocco and Thailand.

Its fake checkout also includes Malaysian bank and wallet branding. ThreatFabric further reported thousands of credential and device records in backend data captured in August 2026, alongside lock-screen history and financial-profile fields.

Hirudo illustrates why banks should not treat an app’s local security signals as conclusive: a replaced app can manipulate what it reports about its own integrity.

ThreatFabric recommends verifying Play Integrity server-side, binding verdicts to sessions and protected actions, checking attestation revocation, and retaining transaction-risk controls for logins, beneficiary changes and payments.

Accessibility and screen-capture indicators remain useful, but should support broader risk scoring rather than act as stand-alone safeguards.

For Android users, the campaign’s key warning is practical: an update prompt inside a shopping or entertainment app can lead to a second, unrelated installation.

Treat requests to install APKs outside trusted app stores with caution, especially when they request Accessibility access or ask you to remove a banking app.

If a banking app unexpectedly disappears or is replaced, avoid signing in and contact the bank through a verified channel.

IOCs

Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.