CSAIS
IDEN
CriticalEarly warningMalwareIndonesia · Indonesian

Malware Android Hirudo Incar 8 Aplikasi Bank di Indonesia, Bisa Curi PIN

First seen 15 Oct, 07:45 WIBLatest 15 Oct14 articles · 12 publishers · 6 syndicated
Verify evidence
54
Confidence index · preliminarycomputed by the pipeline (V0.7)medium
Corroborated by distinct domains
Independent sources
Victim identified
Full text available
Clustering consistency
Status and preventive steps
Early warningMachine output from news coverage; not verified by the public or institutions
Preventive steps
  • Install apps only from official stores and never open APK files sent over chat.
  • Keep the operating system and apps updated and leave built-in protection on.
  • Avoid APKs from outside official stores and review app permissions.
Literacy audienceBank customers and e-wallet usersAndroid users in IndonesiaSocial media and messaging users
Literacy topics
  1. System updates and security patches
  2. The danger of APK files and unofficial apps
  3. How to report and keep evidence

Report toPatroli Siber Polri

Extracted claims

Victimnot found
not identified
Actornot found
not identified
Attack typeconfidence 0.90
Malware2 differing values across articles; review needed.
Event datenot found
not identified
LocationIndonesia
Target groupnot identified
Status
  • D1 Machinemedium trust
Conclusion
  • D1 MachineNot yet certain

Source chronology

14 articles, by publication time

15 October 202614 articles

  1. 07:45 WIBFirst report
    Malware Android Hirudo Incar 8 Aplikasi Bank di Indonesia, Bisa Curi PINinet.detik.com
  2. 07:51 WIB+0 hSyndicated
    Malware Hirudo Sasar Delapan Aplikasi Mobile Banking Indonesiaperadaban.id
  3. 07:51 WIB+0 hSyndicated
    Malware Hirudo Sasar Delapan Aplikasi Mobile Banking Indonesiacirebontimes.com
  4. 07:53 WIB+0 hSyndicated
    Malware Hirudo Sasar Delapan Aplikasi Bank di Indonesiasuaragarut.id
Show all 14 articlesCollapse

15 October 2026 · continued14 articles

  1. 07:53 WIB+0 hSyndicated
    Malware Hirudo Menargetkan Aplikasi Mobile Banking Indonesialensahukum.co.id
  2. 07:55 WIB+0 hSyndicated
    Malware Hirudo Menargetkan 8 Aplikasi Mobile Banking IndonesiaMediaKompeten
  3. 09:50 WIB+2 hSyndicated
    Malware Hirudo Sasar Delapan Aplikasi Bank di Indonesiabsinews.id
  4. 09:51 WIB+2 hSyndicated
    Malware Hirudo Sasar Delapan Aplikasi Bank di IndonesiaSuara Independent News
  5. 09:54 WIB+2 hSyndicated
    Malware Hirudo Sasar Delapan Aplikasi Bank di Indonesiacirebontimes.com
  6. 10:23 WIB+3 hSyndicated
    Malware Hirudo Sasar Delapan Aplikasi Bank di Indonesiachatnews.id
  7. 10:23 WIB+3 hSyndicated
    Malware Hirudo Sasar Delapan Aplikasi Bank di Indonesialensahukum.co.id
  8. 10:25 WIB+3 h
    Malware Hirudo Sasar 8 Aplikasi Bank di Indonesia dan Curi PINlimapagi.id
  9. 10:29 WIB+3 hSyndicated
    Malware Hirudo Sasar Delapan Aplikasi Bank Indonesiademokratis.co.id
  10. 10:59 WIB+3 h
    Malware Hirudo Sasar 8 Aplikasi Bank di Indonesiasuaralandak.co.id
Relations between articles
74 pairs uncertain10 pairs possibly reproduced7 pairs likely reproduced

Evidence

Hashes prepared14full text hashed 0
first evidence_uid79d474f1e33c58654830c40f
14 of 14 evidence records are in Merkle batches

Flow comparison D1–D4

each flow's preventive output; this is where they differ · D1 changed 1 times · since 16 Oct
D1Machine16 OctD2Public surveynone yetHelp reviewD3Institutionnone yetD4Official recordnone yet
Literacy audienceBank customers and e-wallet usersAndroid users in IndonesiaSocial media and messaging users–––
Literacy topics
  1. 1.System updates and security patches
  2. 2.The danger of APK files and unofficial apps
  3. 3.How to report and keep evidence
–––
Preventive steps
  • Install apps only from official stores and never open APK files sent over chat.
  • Keep the operating system and apps updated and leave built-in protection on.
  • Avoid APKs from outside official stores and review app permissions.
Report to Patroli Siber Polri
–––
Institution's reason––––

Columns D2 to D4 fill in once the public survey and institution statements are running.Summary across incidents