Android malware targets banking apps via fake clones

Security researchers have identified a dangerous new wave of Android malware, including the Hirudo strain, designed to steal financial data by replacing legitimate banking applications with fraudulent copies.

According to findings from ThreatFabric and STAR Labs, the malware often disguises itself as harmless applications for shopping, entertainment, or utility services. Once installed, the software requests extensive permissions, specifically targeting Android accessibility services. These permissions allow the malware to read screen content and perform actions on behalf of the user.

Once sufficient control is gained, the malware attempts to uninstall the original banking app and replace it with a modified version that looks nearly identical to the original. This allows attackers to capture sensitive information, such as login credentials, PIN codes, and payment details, while the user remains unaware of the compromise. Researchers analyzed over 60 samples of such malicious applications that utilize Remote Access Trojan (RAT) capabilities to remotely control infected devices.