Cybersecurity researchers at ThreatFabric have uncovered a sophisticated Android banking trojan called Hirudo that replaces legitimate banking applications with maliciously modified versions to bypass security protections, steal financial credentials, and enable remote device compromise. The malware primarily targets eight (8) Indonesian banking applications, with additional credential targeting or potential expansion identified in China, India, Mexico, Morocco, and Thailand. Hirudo is distributed through seemingly legitimate shopping and entertainment applications, promoted through fraudulent Google Play Store pages and social media advertisements. These applications use deceptive update prompts to trick victims into installing the malware and granting Accessibility permissions, allowing attackers to uninstall legitimate banking apps and replace them with trojanized copies. The modified applications incorporate a hooking engine built on the YAHFA and Dobby frameworks to manipulate signature verification, conceal Accessibility services, disable screenshot protections, and circumvent Play Integrity checks through attacker-controlled infrastructure. Once deployed, Hirudo combines banking credential theft with advanced remote access trojan (RAT) capabilities, enabling attackers to steal passwords, payment PINs, device-unlock credentials, and SMS messages while remotely controlling infected devices, streaming screens through WebRTC, and accessing cameras and audio. Researchers also identified thousands of credential records and sensitive device information in an unsecured backend panel, although the total number of victims remains unknown. ThreatFabric warns that Hirudo represents a significant evolution in Android banking malware by shifting attacks from device-level protections to application-level security mechanisms, highlighting the need for server-side integrity verification, behavioral analytics, and transaction-risk monitoring to detect and prevent financial fraud.