This malware does not fake your banking app. It replaces it.

Most Android banking malware draws a fake screen on top of the real app and hopes you type your password into it. Hirudo, documented by the Dutch firm ThreatFabric on 14 October, skips that whole approach. It notices which banking app you already have, shows you what looks like an update prompt, gets you to uninstall the genuine one, and installs its own modified copy in the same place.

That changes everything about what the app can defend itself with. The malicious code is now running inside the banking app's own process, carrying a hooking engine that fakes the signing certificate, returns an empty list when the app asks which accessibility services are active, strips the flag that blocks screenshots, and forwards Google's Play Integrity check to a server the attackers run. The app checks whether it has been tampered with and gets a reassuring answer, because it is asking the tampering.

What it does from there is the usual grim list: credentials, payment PINs, the device unlock code, SMS messages, live remote control of the screen, and access to both cameras. Eight Indonesian banks are targeted so far, with evidence pointing at China, India, Mexico, Morocco and Thailand next. Getting onto the phone still needs a person to install something, and the route is an advert on a Meta platform, a page built to look like Google Play, and a shopping or short-drama app that is really a loader.

That last part travels. An advert, a page that resembles an official store, then a prompt to install an update the store never offered is the same move on Windows, and it still works. Tendvane's safety check for unwanted software flags programs that arrived on your PC by that route, though actually removing malware remains a job for your antivirus.