FluBot Malware Outbreak: What Users Can Do to Curb This ‘Package Delivery’ Text Message Scam

We are here to warn you about a new text message scam using FluBot malware. Android banking malware is spreading across Europe and U.K. Android users. In addition to a few newly added users in the U.S., Threat actors of FluBot malware are running a ‘package delivery’ text message scam. In the scam, they send a message which pretends as a package delivery service such as FedEx, DHL, and Correos, seemingly notifying users of their package delivery status along with a link to track the order. When the user clicks on the link, it downloads malicious apps with the encrypted FluBot module embedded within it. We urge users know more about this FluBot malware outbreak to be protected from being a victim of this text message scam.

Users Affected by FluBot Malware:

Flubot malware is spreading across various countries, predominantly in Europe. It’s also seen there is a rapid increase in the United Kingdom, Germany, Hungary, Italy, Poland, and Spain. In addition to these researches had also found a few new recipients from the U.S.

This attack is most likely targeting Android users. The scam text message containing the link encourages the users to download an application on Android phones. However, Apple users appear to be safe as per the analysis report. But, the scam text messages may still redirect them to a scam website which could steal user’s personal information.

The research also shows that the attacks are most likely targeted Android SDK version 7.0 to 9.0.

How Does FluBot Malware Test Message Scam Spread Across Continents?

It’s revealed from the research that more than 700 unique domains were used in the English language alone. As per the research, initially, the attack started in Germany and later spread to the U.K. It’s estimated that there are 7000 infected devices that were spreading the English language campaign across the U.K., but the actual volume of text messages is unknown. it could be several tens of thousands. Few users reported they have received up to six text messages. The research also says the scam text messages flew to the U.S. from Europe. 

At the time of reporting, the scam is most likely be spreading only through text messages. No email scam emails were observed at this point in time. Here are few sample messages seen in the campaign.

What Is Smishing (SMS Phishing)?

Smishing uses ‘small messaging service’ in short SMS, commonly known as text messaging. In this attack, the attacker sends a fake text message to deliver malicious web links, leading to identity theft, unauthorized access, data exfiltration, and damage to your device. Sometimes it downloads malicious files onto your smartphone, which can be used for malicious reasons like spying, stealing confidential information, credential hijack.

How Does FluBot Malware Infecting Users?

Threat actors running this text message scam are infecting the users using a social engineering technique called ‘Smishing,’ a variant of a Phishing attack. Let’s see how does this attack work.

Please read the full analysis published by Proofpoint.

What Can Users Do To Curb This ‘Package Delivery’ Text Message Scam?

The main reason flourishes such phishing campaigns is lack of user awareness and negligence.

To reduce the chances of becoming a victim of FluBot malware, users must follow these three simple general guidelines: