Hirudo Android trojan replaces banking apps to steal credentials

Security researchers have identified a sophisticated Android banking trojan named Hirudo, which aggressively targets mobile users by replacing legitimate banking applications with counterfeit versions. Unlike traditional malware that uses fake overlays, Hirudo uninstalls the original app and installs a modified copy designed to bypass security checks and steal credentials. The malware often spreads through deceptive advertisements for streaming or shopping services on social media platforms.

While initial targets include eight Indonesian banking applications, the threat extends to users in China, India, Mexico, Morocco, and Thailand. The infection process involves a dropper that tricks users into providing accessibility and notification permissions via fake update requests.

In a broader context, the cybersecurity landscape is shifting due to the rise of agentic AI and quantum computing. Experts emphasize that organizations must move toward proactive, risk-first strategies. The emergence of AI-driven attacks and the potential for quantum computing to threaten current cryptography necessitate immediate planning for quantum-resistant security and the integration of cloud and security operations to prevent data breaches and ensure business resilience.