Hirudo now tracks 42 Android finance apps

Update November 3, 2026: The latest analysis of Hirudo adds that its code keeps a record of 42 financial apps and that dedicated replacements now exist for eight Indonesian banking apps, according to PCrisk. That expands the trojan's documented technical reach, which was already tied to app replacement and credential theft.

An Android trojan identified as Hirudo can replace legitimate banking apps with modified versions and take remote control of a device, according to reports cited by Mallory and CHIP. The available information mentions credential targets associated with Mexico, among other countries, but does not confirm an attack against a Mexican bank or fintech.

What does Hirudo do on the phone?

Hirudo can remove the original app, install a altered version, and bypass signature checks, accessibility controls and Play Integrity queries through hooking mechanisms, according to CHIP. The threat can also capture passwords, PINs, SMS messages and screens, which widens the impact beyond a simple visual swap of the app.

Mallory, citing ThreatFabric researchers, reported that patched versions of eight Indonesian banking apps were identified. That shows the malware is not limited to one country or one banking brand. It can adapt to different targets depending on the environment it finds on the device.

What does the Mexico reference mean?

The Mexico reference appears in the material as an indication of targeting, not as confirmation of a local incident. Both Mallory and CHIP mention credential targets associated with Mexico, but the material itself says there is no confirmed Mexican case.

That distinction matters because it avoids reading the report as a confirmed intrusion against a financial entity in the country. What is established is the trojan's technical ability to replace banking apps and bypass controls meant to validate software integrity on Android.

What limits biometrics and two-factor authentication against this attack?

The material does not describe a failure of biometrics or two-factor authentication itself, but an attack centered on the phone's software. If the trojan manages to install a tampered copy of the app and see what happens on screen, it can intercept credentials and codes before they become an effective defense.

In that scenario, the problem is not only account access. It is the replacement of the legitimate interface with one controlled by the attacker. Hirudo therefore points to a different layer of risk, the Android device itself and the integrity of the apps the user believes they are running.