Plan
active
Hirudo Android malware replaces banking apps to evade security checks
- Engineer — Learn: Hirudo’s technique of swapping patched banking APKs to bypass integrity checks is a novel supply-chain-adjacent pattern worth understanding when evaluating mobile app security controls and app attestation designs.
- SOC/IR — Plan: Build or tune detections for unauthorized APK replacement behavior on enrolled Android devices; review MDM/EMM telemetry for sideloaded or tampered banking apps in the managed estate.
- Leader — Learn: Awareness item for mobile banking risk posture; no immediate vendor exposure or regulatory trigger, but useful context if the organization offers a mobile banking app or mandates banking apps on corporate devices.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.