Security researchers have disclosed a new Android banking trojan called Hirudo that reportedly replaces legitimate banking apps with modified versions designed to bypass the apps’ own built-in security controls. According to mobile security company ThreatFabric, the malware was observed using patched banking applications in a campaign involving Indonesian banks.

Although the reported targets are not European banks, the technique matters because it shows a more advanced form of mobile financial fraud: instead of only overlaying fake login screens or stealing one-time codes, attackers can tamper with the banking app itself so security checks fail from the inside.

What happened

According to ThreatFabric’s published findings, Hirudo is an Android banking trojan that swaps legitimate mobile banking apps for attacker-modified versions. The apparent goal is to undermine security measures that normally protect users during login, transaction approval or fraud detection.

The source report says researchers identified patched replacements for eight Indonesian banking apps. Based on the available information, this is a security research disclosure rather than a public statement from the affected banks in Europe, and the reported activity should not be interpreted as evidence that the same malware is currently targeting European institutions.

Why it matters for European businesses

For European companies, the main significance is the attack method. Many SMEs, founders and finance teams now rely on mobile banking apps for payments, approvals, treasury actions and account monitoring. If an employee’s Android device is compromised, malware that can replace a trusted app with a modified copy may undermine protections that businesses assume are in place.

This creates risk in several areas:

• Corporate banking and payment approvals: mobile authorisation workflows can be abused if a compromised app manipulates what the user sees or disables anti-fraud checks.
• Bring-your-own-device environments: businesses that allow staff to use personal Android devices for finance or admin tasks may have less control over app integrity and device hygiene.
• Executive and finance-team targeting: attackers may focus on people with authority to approve transfers, vendor payments or payroll actions.
• False confidence in app-based security: if the app itself is replaced, some protections inside the original software may no longer provide the expected defence.

The case is also a reminder that mobile threats are increasingly relevant to business cybersecurity, not only consumer banking. For smaller companies, a single compromised device used for banking or administrator access can have immediate financial consequences.

Who may be affected

• SMEs using Android devices for business banking
• Finance teams and company directors approving payments on mobile
• E-commerce businesses with frequent payment operations and account access on smartphones
• IT and security teams responsible for mobile device policies
• Digital agencies and service providers managing client payment, ad spend or financial tools on shared mobile devices

What companies should consider

• Review mobile banking practices: identify which employees use Android devices for banking, payment approvals or access to finance platforms.
• Restrict high-risk installation behaviour: discourage or block app sideloading and require apps to be installed only from approved sources where possible.
• Use mobile device management controls: for company-managed devices, apply policies for app installation, device compliance and security monitoring.
• Separate duties for payments: avoid relying on a single mobile device or one person for high-value transaction creation and approval.
• Watch for signs of compromise: unexpected app behaviour, repeated login prompts, disabled security features or unusual permission requests should trigger investigation.
• Confirm critical transactions out of band: for larger payments, use a secondary verification step that does not depend on the same mobile device.
• Update awareness training: include mobile malware and tampered-app risks in finance, executive and admin security training.

At this stage, the reported campaign is tied to Indonesian banking apps, but the underlying approach is relevant more broadly. European businesses should treat it as a warning that mobile banking fraud is evolving beyond phishing and SMS interception toward deeper tampering with trusted applications themselves.