Hirudo banking trojan response

The 19 October 2026 mobile-security analysis describes a Hirudo chain that bypasses signature continuity by inducing removal of the genuine Android banking application before a trojanized replacement is installed.

It also reports manipulation of certificate, Accessibility, screen-capture, and Play Integrity results.

Banks can act on observable signer changes, sideloading, Accessibility activation, re-enrollment behavior, and network telemetry now, while withholding production ingestion of package and hash indicators until the set is independently verified.

Customers with an installed replacement can also reduce exposure immediately by stopping banking activity, resetting the infected handset, and replacing credentials and sessions from a clean device.

Three groups are directly affected.

First, Indonesian banks whose genuine Android banking applications may be replaced face suspicious re-enrollment, untrusted sessions, and local integrity results that may be manipulated; their fraud, enrollment, authentication, and security-monitoring teams must enforce server-side controls.

Second, Android banking customers who uninstalled a genuine application and installed a trojanized replacement, especially where Accessibility is active, face malicious interaction and live screen access through Hirudo and must treat banking credentials and sessions as needing replacement from a clean device.

Third, managed-device teams responsible for those Android handsets must detect sideloading, signer changes, Accessibility activation, and trust changes and verify recovery before restoring device trust.

The evidence does not identify exact Android versions, handset models, bank-application versions, or a complete list of affected banks.

Support — The mobile-security analysis dated 19 October 2026 describes victims being induced to uninstall genuine Android banking applications and install trojanized replacements.

It reports YAHFA/Dobby-based hooks substituting certificate data and suppressing Accessibility, screen-capture, and Play Integrity results, with Accessibility and WebRTC then supporting interaction and live screen access.

Support — The evidence audit found direct guidance for using package and hash indicators, invalidating sessions after suspicious re-enrollment, requiring independent-channel authentication, making fresh integrity decisions on bank servers, rotating credentials from a clean device, and factory-resetting a handset when Hirudo was installed.

Insufficient evidence — A separate recovery review found support for stopping banking activity, removing suspicious services and applications, and factory reset, but not for mandatory isolation or controlled reinstall.

Evidence gap — The indicator review found several package names and a statement that hashes and other indicators were published, but no complete indicator set or captured authoritative source suitable for operational ingestion.

The mobile-security analysis surfaced the Hirudo attack chain: victims are induced to uninstall genuine Android banking applications and install trojanized replacements, after which YAHFA/Dobby-based hooks reportedly manipulate certificate and local-security results while Accessibility and WebRTC support interaction and live screen access.

The decision scout translated that analysis into controls for banks and recovery steps for customers.

The evidence audit supported session invalidation, independent-channel authentication, fresh server-side integrity decisions, clean-device credential replacement, and factory reset after installation.

It found insufficient evidence for mandatory device isolation or controlled reinstall and found that the complete indicator set lacked an authoritative captured source. The boundary review required those unsupported steps to be removed and indicator ingestion to depend on independent verification.

The arbiter adopted that narrowed position as a new decision, while the record-linking check reported that no prior target had been returned for comparison.