ThreatFabric finds Hirudo trojan that replaces banking apps with tampered copies

ThreatFabric has identified Hirudo, a new Android banking trojan that steals login credentials and gives attackers live remote control of infected phones. It replaces genuine banking apps with modified copies that disable the banks' own security checks, while also capturing screens, accessing the camera and stealing SMS. It currently targets seven banks and eight Indonesian banking apps, with code references to targets in China, India, Mexico, Morocco and Thailand.

• Trojan swaps the real banking app for a modified copy that disables security checks
• Steals credentials, screen and camera data, SMS, and enables remote device control
• Targets 7 banks and 8 Indonesian apps, with code naming 5 more countries
• Delivered via shopping and entertainment apps as a separate install package