{"id":245408,"date":"2026-10-15T01:40:45","date_gmt":"2026-10-15T06:40:45","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/10\/hirudo-android-trojan-uses-patched-banking-apps-to-bypass-their-built-in-security-checks"},"modified":"2026-10-15T01:40:45","modified_gmt":"2026-10-15T06:40:45","slug":"hirudo-android-trojan-uses-patched-banking-apps-to-bypass-their-built-in-security-checks","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/10\/hirudo-android-trojan-uses-patched-banking-apps-to-bypass-their-built-in-security-checks","title":{"rendered":"Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/hirudo-android-trojan-uses-patched-banking-apps-to-bypass-their-built-in-security-checks.webp\"><\/a><\/p>\n<p>\u201cHowever, Play Protect also provides offline detection for known potentially harmful applications, meaning that the mechanism does not completely disable its protection,\u201d ThreatFabric noted last month. \u201cWe therefore assess that the technique is more likely intended to reduce the effectiveness of online reputation and code-analysis mechanisms rather than bypass Play Protect entirely.\u201d<\/p>\n<p>Depending on the nature of the lure app used, the dropper is also designed to serve bogus screens to capture payment PINs, serve fake screens requesting login credentials for banks and wallet apps, display fake lock screen pattern and PIN overlays, and facilitate total remote control of the device.<\/p>\n<p>While all this behavior is par for the course when it comes to Android banking trojans, it\u2019s their attempts to replace the target banking app with a tampered copy that stand out. Specifically, the purpose-built replacements embed a hooking engine to blind signature, accessibility, screen-capture, and Play Integrity checks from within the app. The replacement targets eight Indonesian apps.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u201cHowever, Play Protect also provides offline detection for known potentially harmful applications, meaning that the mechanism does not completely disable its protection,\u201d ThreatFabric noted last month. \u201cWe therefore assess that the technique is more likely intended to reduce the effectiveness of online reputation and code-analysis mechanisms rather than bypass Play Protect entirely.\u201d Depending on the [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34,45,6],"tags":[],"class_list":["post-245408","post","type-post","status-publish","format-standard","hentry","category-cybercrime-malcode","category-finance","category-robotics-ai"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/245408","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=245408"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/245408\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=245408"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=245408"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=245408"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}