A Short-Drama App Deleted a Banking App and Installed an Identical Fake
You tapped 'Update' in a short-drama app — and a few days later your banking app has become a tampered build that only looks the same. Here is a rundown of Hirudo, the Android malware disclosed by security firm ThreatFabric: why it works, and what you can check right now.
Picture a row of lockers at the end of a school hallway. On my locker hangs the blue combination lock I bought myself. Every morning I dial the numbers and it clicks open. That sound is so familiar that I have never once stopped to inspect the lock itself.
One day somebody quietly removes that lock. In its place they hang a lock of the same color and the same shape. I dial my numbers and it still clicks open. There is only one difference. The new lock secretly writes down the numbers I pressed.
This is exactly what the Android malware disclosed this week does. Instead of a lock, it swaps out your banking app.
What Happens — A Few Days in One Person’s Life
FACT Security firm ThreatFabric disclosed a new piece of Android malware on October 14, 2026. Its name is Hirudo. It is remote-control malware. In plain terms, a program that operates someone else’s phone from a distance.
Let us walk through the scenes in order.
Day one. You install a short-drama app — an app for watching short dramas back to back. The dramas play fine and the app works properly. Then an “update” notice appears inside the app. Tap it, and it asks you for permissions.
FACT The report lists four decoy apps: the short-drama apps KoiShort and ZoyaTV, the shopping app Shopora, and the adult video app 1V1 X. All of them do their advertised job on the surface. That is what makes them hard to suspect. Tapping the in-app “update” installs the real malware payload. The payload then tries to obtain accessibility permission and notification access permission.
Let us be clear about what accessibility permission is. It is a feature originally meant to help people who have trouble seeing the screen or using their hands. It reads the contents of the screen and presses buttons on the person’s behalf. In locker terms, it is permission to “stand in front of my locker and move in place of my hands.”
A few days later. This time an update notice appears on the banking app. But what opens is not an update screen — it is the uninstall screen. And then the banking app is installed again. Same icon, same name.
FACT The payload first looks at which banking apps are installed on the phone. It also checks those apps’ signatures. Then it shows a fake update notice. It deletes the genuine app through the Android uninstall screen and, at the same time, downloads a tampered build. The hand that removes the lock and the hand that hangs the new one belong to the same person.
FACT There is one more scene that plays out separately. You open the order screen in the short-drama app to make a payment. A transparent fake payment window is laid over it. To your eyes it looks like the payment window. Enter your bank payment password here and it goes to the attacker. The decoy app gets back a false result reading “payment successful.” So you believe the payment went through.
Why It Works — How to Fool the Lock Inspection
FACT The swapped-in banking app has the same package name as the original app. A package name is the unique label a phone uses to tell apps apart. The code is nearly unchanged as well. So it works just as it always did. It is the same as the new lock that clicks open when you dial your numbers.
What changed is the mechanism hidden inside. The tampered build contains a hooking engine. Hooking is a technique that cuts into an app mid-task and swaps out the result. This engine was built on top of the public tools YAHFA and Dobby.
FACT Banking apps run lock inspections of their own. The tampered build switches off four of them.
| The banking app’s check | What it looks at | In locker terms |
|---|---|---|
| Signature verification | Was this app really built by that bank | The manufacturer’s stamp on the back of the lock |
| Accessibility detection | Is someone else pressing the screen for you | Is there a person next to you moving in place of your hands |
| Screen capture blocking | Stops the screen from being secretly recorded | A screen so no one can peer inside the locker |
| Play Integrity check | In Google’s view, is this an untampered app and phone | The authenticity sticker the school put on |
INFERRED These four checks exist precisely so that you notice “the lock has been changed.” When they are switched off, the banking app raises no warning. Which means the judgment “the banking app didn’t say anything, so I’m fine” does not hold this time.
FACT What this malware extracts does not stop at payment passwords. It takes login passwords for banks and e-wallets. It takes the phone’s lock password and lock pattern too. It also accesses text messages, the screen, audio, and the front and rear cameras.
FACT Even so, there is a gap. The signing keys used to build the tampered versions were keys that had already leaked. Google placed some of those certificates on a revocation list — something like a list of stamps reported lost. If a bank checks that list on the server side, it can catch the forgery.
The Scale in Numbers
FACT
| Number | Meaning |
|---|---|
| 42 | Financial apps whose passwords this malware targets |
| 8 | Banking apps with tampered builds prepared in advance (7 banks) |
| 8 | Languages supported by the fake payment window |
The 42 are a list of passwords to steal. The 8 are a list of apps to swap out wholesale. Eight out of 42 — roughly one in five — means they went as far as carving the replacement lock ahead of time. One infection puts several of the financial apps on your phone on the target list at once.
FACT The 8 banking apps with tampered builds ready are all Indonesian banks. The password-theft list also includes financial apps from China, India, Mexico, Morocco, and Thailand. The fake payment window uses Malaysian bank and e-wallet brands. Eight languages means they are not aiming at the people of just one country.
FACT The malicious installation files were set up to be downloaded not from Google Play but from an external server — a file delivery service called Amazon CloudFront. One download page archived in June had an install button dressed up to look like the Play Store.
What I Should Do Now
The report contains nothing about Korean banking apps being targeted. Even so, the technique itself works the same way on a phone in any country. There are only two things to remember.
1. If an app tells you to “download the update file,” don’t tap it. Open the Play Store yourself instead and look the app up there. If there really is an update, it will show up there. It is like going to the school office in person when a lock needs replacing. You do not accept a lock somebody hands you in the hallway.
2. If a banking app opens the uninstall screen by itself, stop right there. Here is what to do next.
- Go into the Accessibility menu in Settings and turn off any app you do not recognize that is switched on.
- Scan your phone with Play Protect. It is the feature with which Google looks over the apps installed on your phone.
- Notify your bank’s customer service.
Gathered up one line at a time, the warning signs are these.
- A drama or shopping app demands an installation file from outside the store, or accessibility permission, citing an “update.”
- A banking app opens the uninstall screen on its own, saying it will update.
- You are paying inside a drama or shopping app and a window appears asking for your bank payment password.
INFERRED Back to the locker: the fact that a lock looks the same proves nothing. The grounds for trusting it are where you got that lock from. Apps, too, should be trusted by where you got them, not by their icon.
What We Don’t Know
These are the things about this case that have not yet been established. We are not going to pretend to know.
- We don’t know how many people were infected. The attacker’s server was exposed to the outside, and all that is known is that “thousands” of records of login credentials such as passwords were found on it. There is no exact figure. This record count must not be read as a victim count.
- There is nothing indicating that Korean banks or Korean users were targeted. The confirmed targets of tampered builds are Indonesian banks.
- We don’t know who presses “uninstall” when the banking app is deleted. Whether the user taps it themselves or it is tapped automatically via accessibility permission is not clear even in the original report. The report says only that the user can stop the deletion partway through.
- How it spread has not been established. The claim that it may have spread through paid social media ads is an inference based on ad-tracking code inside the app.
- The names of the 7 Indonesian banks with tampered builds prepared have not been disclosed.
- We don’t know whether the decoy apps were ever listed on Google Play. The distribution point named in the report is an external server.
- We don’t know who built it. The name of the attacking group has not been identified. We do not speculate about nationality or affiliation either.
Sources
- ThreatFabric (primary source), “Hirudo: from fake updates to patched banking apps”, 2026-10-14 — https://www.threatfabric.com/blogs/hirudo-from-fake-updates-to-patched-banking-apps
- BleepingComputer, “Hirudo Android malware replaces banking apps to evade security checks”, 2026-10-14 — https://www.bleepingcomputer.com/news/security/hirudo-android-malware-replaces-banking-apps-to-evade-security-checks/
This post is not based on our own honeypot observations. It was compiled on 2026-10-15 by cross-checking the original ThreatFabric report against BleepingComputer’s reporting. We found no contradictions between the two sources, and we found no Korean press coverage. This post does not include IP addresses, credential values, or malicious file addresses. The number of infections, whether Korea was targeted, who presses the uninstall confirmation, and the distribution route have not been confirmed.