Android Malware Hirudo Replaces Banking Apps

ThreatFabric analyzes a novel Android remote access trojan named Hirudo that targets eight Indonesian banking apps. The malware installs a dropper via fake shopping or adult video apps to uninstall legitimate applications and replace them with modified versions. This process steals credentials, captures live camera feeds, and grants remote control for 90 days.