New Android Malware Replaces Legitimate Banking Apps With Malicious Copies to Bypass Security Checks

A newly identified Android banking Trojan called Hirudo takes an unusual route to financial fraud: it tries to remove a victim’s genuine banking app and install a modified copy in its place. The replacement keeps the bank app’s name and version, but contains extra code designed to interfere with security checks. Instead of relying only on fake login screens displayed over a real app, Hirudo’s operators try to make the banking app itself return answers that hide the malware’s presence. The campaign combines app replacement with credential theft and remote control of infected phones. Its operators can seek banking passwords, payment PINs, SMS messages and device-unlock details,…