Hirudo makes "check the app" useless advice. Check the source

"Make sure the app looks right" has been standard security advice for years. Now try following it when the malware itself deletes your real banking app and installs a lookalike that behaves the same. That is the uncomfortable lesson of Hirudo.

According to CHIP's report on the ThreatFabric findings, Hirudo poses as a shopping, entertainment or short-video app. Once installed, it asks for permissions under a pretext, including accessibility services. It then removes the original banking app, downloads a modified version and installs it. ThreatFabric has found copies of eight banking apps so far.

The tampered app looks largely like the original. Attackers can reportedly capture banking passwords, payment and device PINs, SMS messages and screen content, and even abuse the camera and microphone. The first cases involved Indonesian banking apps, with signs of attacks on financial organizations in China, India, Mexico, Morocco and Thailand. The number of victims is unknown, but is said to run into the thousands.

The checks we trusted are the ones being bypassed

The scary part isn't the fake app. Fake apps are old news. It's that a built-in hooking mechanism can reportedly get around signature checks, accessibility controls and Play Integrity queries, the very safeguards we expect to catch tampering. A bank can't easily tell "my real app" from "a copy that answers like my real app" if everything the check relies on runs on the compromised phone.

For users, the old tips ("look at the icon," "check the name," "make sure it's the right version") now fall short. One secondary write-up, shattered.io, even says the replacement carries the same name and version as the original. We'd say that advice is obsolete for this class of threat. You can't verify an app by eye once the attacker controls what you see.

Where the real defense lives: before the install

If the app can't be trusted after the fact, the decision that matters is the earlier one: what you let onto the phone. Hirudo doesn't start with a bank app. It starts with a harmless-looking shopping or video app, and with you granting accessibility access. So we'd put it bluntly:

• Install only from official sources. Don't open APK files from unknown stores, however good the deal sounds.
• Treat an accessibility permission request from a shopping or video app as a red flag. Our opinion: if a casual app needs it, delete the app.
• Keep the device updated and run Play Protect scans regularly, as the CHIP piece recommends.

None of this is glamorous, and Play Protect isn't magic. But in our view these are the habits that work before the damage is done. We'd rather rely on a boring habit than on a bank app's self-check.

Banks must move the check off the phone

The recommendation for banks is the most telling part: tie security checks to the server side and to specific transactions. We read that as a tacit admission that device-side checks alone don't hold. In our view, that's where the industry is headed, and users should probably expect more confirmation steps on payments. Annoying, yes, but better than a fake payment page that shows "success" after taking your data.

Treat your install source as the lock on the door

If you suspect an infection, the BSI advice cited by CHIP is to check recently installed apps and delete them first. After that, scan with an up-to-date antivirus, try safe mode, and use a factory reset as a last resort, which is why backups matter. But prevention is far cheaper. Treat your install source as the lock on the door, not as a preference. Hirudo shows that once something is inside, "looks fine" tells you nothing.