New Android Malware Replaces Banking Apps With Fake Replicas

Security analysts have uncovered a dangerous new attack method targeting the Android operating system through malicious software known as Hirudo. According to safety experts at ThreatFabric, the malware bypasses conventional phishing techniques by completely replacing legitimate banking software with manipulated counterfeits rather than simply overlaying fake login screens.

The infection typically begins when users download everyday applications disguised as regular shopping utilities, entertainment programs, or short-video platforms. Once installed, these fraudulent programs request extensive permissions to access Android accessibility features. If victims grant these privileges, the malicious software initiates the core assault by deleting the original banking application from the device, downloading a customized replica from the web, and installing it onto the smartphone.

ThreatFabric researchers have identified counterfeit copies affecting eight different banking applications. These modified versions closely mirror the official software of respective financial institutions, making the swap difficult for users to detect initially. Once active, the fraudulent applications enable attackers to capture online banking credentials, transaction PINs, and device passcodes while monitoring text messages and screen contents.

To evade detection by built-in operating system security measures, Hirudo utilizes an integrated hooking mechanism designed to bypass standard signature checks, accessibility controls, and queries through Google's Play Integrity interface. Initial cases of this attack pattern appeared in financial applications in Indonesia, with additional indicators pointing toward targeted actions in China, India, Mexico, Morocco, and Thailand affecting thousands of devices.

Security specialists advise users to treat accessibility permission requests from simple applications as a major warning sign. Experts recommend downloading software exclusively through official platforms and running regular scans using Google Play Protect. For users suspecting an infection, the German Federal Office for Information Security recommends manually checking recently installed programs, performing a virus scan, utilizing safe mode if necessary, or resetting the device to factory settings as a final resort.

Meanwhile, mobile users face broader platform shifts as software support cycles evolve. Google recently announced that the November 2026 security update marks the official end of regular monthly firmware patches for the Pixel 6 and Pixel 6 Pro devices released in 2021. While modular updates via Google Play System Updates continue to refresh runtime libraries, low-level vulnerabilities in hardware components and kernel drivers will remain unpatched on these older devices, leaving users who handle sensitive data facing decisions regarding hardware upgrades.