ThreatFabric-documented 'Hirudo' is a new Android banking trojan distributed outside official app stores via dropper apps posing as shopping (Shopora), adult-content (1V1 X) and short-drama (ZoyaTV, KoiShort) applications that display a fake "update" notification prompting victims to grant Accessibility permissions. Hirudo then uninstalls the legitimate banking app and downloads a patched clone that retains almost all of the original's code but loads a hooking engine built on the open-source YAHFA and Dobby frameworks. When launched, the clone substitutes the genuine signing certificate when queried, hides enabled Accessibility services, removes screenshot protection, and modifies key-attestation certificates while relaying Play Integrity requests through an operator-controlled server — defeating app-signature, Accessibility and Play Integrity checks from inside the app's own process. ThreatFabric found malicious copies of eight banking apps impersonating at least seven Indonesian banks, with targets also in China, India, Mexico, Morocco and Thailand, and thousands of credential entries in an unsecured backend panel. AU/NZ banks' device-attestation and app-integrity layers are active evasion targets; server-side attestation validation and behavioural fraud controls are the recommended counter.

• Source article