[CLSTR]
< Back to situations

Monitor this situation.

[SITUATION] · [ACTIVE] · [TECHNOLOGY]

3 clusters · 24 sources · 26 days · First seen · Last updated

Android banking trojan evolution

Overview

Cybersecurity researchers have identified evolving threats targeting Android mobile banking users through sophisticated malware strains.

In late September 2026, reports emerged regarding the RatHat and RemControl trojans. RatHat utilizes Google’s Gemini AI to analyze intercepted messages and estimate victim bank balances, allowing operators to prioritize high-value accounts. Cleafy reported approximately 100 deployments of the RatHat control console since April 2026. RemControl has targeted over 30 financial institutions across Europe, including France, Italy, Spain, Poland, and Portugal, with researchers noting that portions of its code were generated using AI assistants to bypass security restrictions.

By mid-October 2026, a new strain named Hirudo was discovered. Unlike previous methods using fake overlays, Hirudo aggressively replaces genuine banking applications with nearly identical counterfeit versions to steal credentials and intercept security codes. Researchers at ThreatFabric and STAR Labs noted that the infection typically begins through deceptive online advertisements for shopping, entertainment, or streaming services. Once installed, the malware uses a false update prompt to gain accessibility and notification permissions, allowing it to trigger an uninstaller for the original application while simultaneously installing the malicious copy.

While RemControl and Hirudo are frequently distributed via social media platforms like Facebook and Instagram, Hirudo has specifically targeted eight banking applications in Indonesia. The malware is also attempting to steal credentials from users in China, India, Mexico, Morocco, and Thailand. Researchers have analyzed over 60 samples of such malicious applications that utilize Remote Access Trojan (RAT) capabilities to remotely control infected devices.

Entities

Android · ThreatFabric · Hirudo · Google · Hirudo

Timeline

  1. [TECHNOLOGY] 9 sources
    Android malware targets banking apps via fake clones

    New Android malware, including the Hirudo strain, targets banking users by replacing legitimate apps with fake, identical copies to steal credentials and financial data.

  2. [TECHNOLOGY] 13 sources
    Hirudo Android trojan replaces banking apps to steal credentials

    A new Android trojan called Hirudo is replacing legitimate banking apps with counterfeit versions to steal credentials, marking a sophisticated evolution in mobile cybersecurity threats.

  3. [TECHNOLOGY] 2 sources
    AI-powered Android banking trojans target financial institutions

    New Android banking trojans, RatHat and RemControl, are using artificial intelligence to target financial institutions and prioritize high-value victims through sophisticated data theft techniques.

Sources

amy-movie.com · android-mt.ouest-france.fr · ans.co.uk · canaltech.com.br · care.ac.in · chip.cz · cybernoz.com · defesaemfoco.com.br · economiematin.fr · europesays.com · forbesliberia.com · gulfnews.com · itvesti.info · marqueestaffing.com · metropolitan.si · mladina.si · n1info.si · obalaplus.si · siliconangle.com · techbyte.sk · tek.sapo.pt · times.si · tn.nova.cz · xcitium.com

This summary has been updated 2 times: see revision history