What ThreatFabric says Hirudo does to a banking app

What the report is claiming

On October 14, 2026, ThreatFabric said it was tracking an Android banking trojan it calls Hirudo. The report's distinction is that, for banks it has prepared for, the trojan tries to replace the banking app with a modified copy instead of drawing a fake screen over the genuine app. It says eight Indonesian banking apps, across seven banks, have those dedicated copies, while a registry lists 42 financial apps. The page filing that distinction is The document named in the sources is the record this page will keep.Futureweb.

What this page will not turn into instructions

The report describes delivery through shopping and entertainment apps that carry a separate package, and it describes the impact as credential theft plus remote control of the phone. This brief stops there. It does not name packages, it does not describe how a check inside an app is blinded, and it does not tell a reader how to spot a prompt. The desk is Asked directly, What would change the replacement sentence? A correction from ThreatFabric, or a bank notice that names a different count. A second writeup of the same report would not.Mobile.

What the other accounts are

BleepingComputer and The Hacker News published accounts the same day. They are useful as evidence that the report was public, not as a second measurement. Where they add a procedure, this page leaves it on their site. An app sandbox, the standing limit under a replaced install, is Asked directly, Which apps does the report say have dedicated replacements? Eight Indonesian banking apps, covering seven banks. The report also says Hirudo keeps a registry of 42 financial apps, and that only those eight have the dedicated copies.what an app sandbox stops.

Why it matters on this desk

The dependency is the phone, not a network appliance. A reader who banks in one of the seven Indonesian institutions the report names is in the set the report says was given a dedicated copy. A reader outside that set is not automatically in it, because the report separates the registry of 42 from the eight copies. The security desk, for an advisory with a vendor patch, is The document named in the sources is the record this page will keep.Security.

What is still unknown

The report does not, in the text this page is using, name a store removal, a bank customer notice, or a version of Android that blocks the replacement. Those would be different documents. Store review, which this report is not, is The short answer this page will stand on is this: It says Hirudo tries to replace a banking app with a modified copy, rather than painting a fake screen on top of the real one. It says eight Indonesian apps, across seven banks, have those replacements. It does not publish a patch.what store review does not prove.

What this page will not treat as a patch

No bank bulletin is a source here. No fixed app version is stated. Updating a phone because a headline said trojan is not a version this brief can name. The only count this page will repeat is the one in the report: eight apps, seven banks, forty-two in the wider registry. Asked directly, What impact does ThreatFabric name, without a procedure? On-device credential theft and live remote control of the phone, delivered by shopping and entertainment apps that carry a separate package.

What to watch next

A ThreatFabric update that changes the eight, or a notice from one of the banks, would replace this page. A removal from a store, if a store posts it, would be a new fact. Another synopsis of the October 14 report would not. A permission prompt, a different mobile control, is Asked directly, Do BleepingComputer and The Hacker News add a different mechanism? They are accounts of the same report. This page does not import a step-by-step description from either.a permission prompt and the scope.

What would change the record

If the researchers say the replacement copies were a lab reconstruction and not observed in use, the impact sentence changes. If a bank says its app was not in the eight, the count changes. A headline that says all mobile banking is affected would be wider than the report, and this page will not adopt it. Asked directly, Is this a bank advisory? No. The primary document is a threat-intelligence report. It is not a notice from the seven banks.

What stays the report's distinction

What stays specific is an October 14, 2026 ThreatFabric report: an Android trojan the firm calls Hirudo, a claim that it replaces selected banking apps instead of overlaying them, eight Indonesian apps across seven banks with dedicated copies, and a wider registry of 42. BleepingComputer and The Hacker News are the same-day accounts. They do not add a patch, and this page does not invent one. No indicator list is included. No installation step is included. The phone user in scope is the one whose bank is in that dedicated set, and everyone else is outside the sentence the report actually wrote. A later bank notice would be a better document than a second retelling. Until that notice exists, the report is the record, and the two outlets are the check that it was published.