Learn
archived
Hirudo Android Trojan Replaces Banking Apps With Patched Versions
- Engineer — Learn: Novel technique of substituting legitimate banking apps with trojanized patched variants that bypass internal integrity checks is relevant to mobile app security design; no cloud/infra exposure and no KEV or PoC to force immediate action.
- SOC/IR — Learn: The app-replacement TTP is a meaningful escalation in mobile banking fraud, but no IOCs, ATT&CK mappings, or enterprise-estate detection surface were published; file away for context if mobile MDM telemetry is in scope.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.