Ankura CTIX FLASH Update – October 16, 2026

Malware Activity

Hirudo Android Banking Trojan Replaces Legitimate Apps to Bypass Security Controls and Steal Financial Data

Cybersecurity researchers at ThreatFabric have uncovered a sophisticated Android banking trojan called Hirudo that replaces legitimate banking applications with maliciously modified versions to bypass security protections, steal financial credentials, and enable remote device compromise. The malware primarily targets eight (8) Indonesian banking applications, with additional credential targeting or potential expansion identified in China, India, Mexico, Morocco, and Thailand. Hirudo is distributed through seemingly legitimate shopping and entertainment applications, promoted through fraudulent Google Play Store pages and social media advertisements. These applications use deceptive update prompts to trick victims into installing the malware and granting Accessibility permissions, allowing attackers to uninstall legitimate banking apps and replace them with