ThreatFabric's Hirudo writeup describes lure apps (shopping, adult video, short drama) that drop a separate RAT behind a fake in-app "update". The RAT then uninstalls 8 Indonesian banking apps (covering 7 banks) and installs test-key-signed replacements. A YAHFA/Dobby hooking engine inside each replacement spoofs the signing certificate, hides Accessibility services, strips FLAG_SECURE, re-signs attestation with a publicly leaked keybox, and relays Play Integrity over plain HTTP to an operator server. Credential targeting also covers China, India, Mexico, Morocco and Thailand. Server-side hunt ideas (banks/fintech): check attestation chains against Google's revocation list, bind Integrity verdicts to the session and action, and flag sessions where behavioral telemetry suddenly drops out. Network/MDM: block the IOCs below. Lure packages: com.agbbh.kjdrttt, com.onev.vip, com.koishort.app, com.zoyatv.app. RAT: com.zk7qpx.mv9wlt, com.r9nkvx.qw2mpl.

// KQL sketch (proxy/DNS/MDM network logs) - adapt table names
let hirudo = dynamic(["helloharmonyos.com","jiekou.baojingtextile.cn",
  "d3s06yhcwfnwcx.cloudfront.net","d21gcldn8gp80l.cloudfront.net",
  "dydjjnnjg7jeb.cloudfront.net","d3q4tlm7pw29zr.cloudfront.net"]);
let hirudoIP = dynamic(["134.122.153.136","43.225.157.157","134.122.153.68",
  "134.122.153.92","18.139.79.161"]);
NetworkLogs
| where TimeGenerated > ago(30d)
| where DestinationHost has_any (hirudo) or DestinationIP in (hirudoIP)
| summarize hits=count(), first=min(TimeGenerated) by DeviceId, DestinationHost, DestinationIP