HIRUDO ANDROID MALWARE REPLACES BANKING APPS TO EVADE SECURITY CHECKS

Summary from the TLDR InfoSec newsletter

Security researchers at ThreatFabric released a report on a malware campaign that targets Android users by impersonating banking apps. The malware is delivered via shopping, adult content, or short-drama apps that appear legitimate but then request additional permissions, such as Accessibility, for an “update.” The malware then launches the legitimate banking app's uninstaller, downloads a patched copy, and abuses its Accessibility permissions to install it.