FluBot Malware Outbreak: What Users Can Do To Curb This ‘Package Delivery’ Text Message Scam

We are here to warn you about a new text message scam using FluBot malware. Android banking malware is spreading across Europe and U.K. Android users. In addition to a few newly added users in the U.S., Threat actors of FluBot malware are running a ‘package delivery’ text message scam. In the scam, they send a message which pretends as a package delivery service such as FedEx, DHL, and Correos, seemingly notifying users of their package delivery status along with a link to track the order. When the user clicks on the link, it downloads malicious apps with the encrypted FluBot module embedded within it. We urge users know more about this FluBot malware outbreak to be protected from being a victim of this text message scam.

Users Affected By FluBot Malware:

Flubot malware is spreading across various countries, predominantly in Europe. It’s also seen there is a rapid increase in the United Kingdom, Germany, Hungary, Italy, Poland, and Spain. In addition to these researches had also found a few new recipients from the U.S.

This attack is most likely targeting Android users. The scam text message containing the link encourages the users to download an application on Android phones. However, Apple users appear to be safe as per the analysis report. But, the scam text messages may still redirect them to a scam website which could steal user’s personal information.

The research also shows that the attacks are most likely targeted Android SDK version 7.0 to 9.0.

How Does FluBot Malware Test Message Scam Spread Across Continents?

It’s revealed from the research that more than 700 unique domains were used in the English language alone. As per the research, initially, the attack started in Germany and later spread to the U.K. It’s estimated that there are 7000 infected devices that were spreading the English language campaign across the U.K., but the actual volume of text messages is unknown. it could be several tens of thousands. Few users reported they have received up to six text messages. The research also says the scam text messages flew to the U.S. from Europe. 

At the time of reporting, the scam is most likely be spreading only through text messages. No email scam emails were observed at this point in time. Here are few sample messages seen in the campaign.

What Is Smishing (SMS Phishing)? 

Smishing uses ‘small messaging service’ in short SMS, commonly known as text messaging. In this attack, the attacker sends a fake text message to deliver malicious web links, leading to identity theft, unauthorized access, data exfiltration, and damage to your device. Sometimes it downloads malicious files onto your smartphone, which can be used for malicious reasons like spying, stealing confidential information, credential hijack.

How Does FluBot Malware Infecting Users?

Threat actors running this text message scam are infecting the users using a social engineering technique called ‘Smishing,’ a variant of a Phishing attack. Let’s see how does this attack work.

1. Each FluBot malware attack begins with sending a text message impersonating a package delivery service to a potential victim.
2. Each message will have a malicious link to a compromised site that is serving the malicious apk files.
3. When a user follows the link, it prompted the user to download a fake delivery service app in which FluBot malware has embedded inside.
4. Upon installing the malicious apk file, it asks the user to give full access to the device. If the user clicks ‘Ok,’ the FluBot malware will gain full access through Android Accessibility Service and Notification access.
5. Once the FluBot has full permission, it acts as a spyware, SMS spammer, and credit card and banking credential stealers.
6. The malware sends the victim’s contact list to the C2 server and continues its spread campaign using the victim’s device.

Please read the full analysis published by Proofpoint.

What Can Users Do To Curb This ‘Package Delivery’ Text Message Scam?

The main reason flourishes such phishing campaigns is lack of user awareness and negligence.

To reduce the chances of becoming a victim of FluBot malware, users must follow these three simple general guidelines:

• Be aware of unexpected text messages. Don’t click on links shared by an unknown source.
• Don’t install any applications outside of legitimate app stores.
• The most critical part is giving permissions. Never hit ‘Ok’ when it asks permission. Read before you grant permissions.
• Visit the official package delivery website to track the shipment. Don’t click on the link shared through the message.

Android Users From The U.K.:

Do this if you receive a scam text message:

• Follow all the general guidelines.
• Forward the message to 7726, a free spam-reporting service provided by phone operators.
• Delete the message.

Do this if you have already clicked on the link to download the app:

As you have clicked the link, your online accounts and passwords could be at risk. Bot uses that device to log into any accounts until you have followed the below sanity steps.

• Perform a factory reset as soon as possible. Note: Don’t use your backups to restore the data as they could be infected.
• If you ever log in to any app or account after installing the malicious app. Reset passwords of all the accounts.

Do this to protect yourself from such scams in feature:

• For Android devices, enable Google’s Play Protect service is enabled on your device.
• Install each application from the Google Play store and configure everything from the beginning.
• After setting up everything, take the backup. This would protect your data if your device infected again.

FluBot Malware IOCs:

FluBot v3.7

FluBot v4.0

Thanks for reading this article. If you found this article interesting, visit our site to read more such interesting articles.

• New WhatsApp verification code scam: How to protect WhatsApp account from hackers?
• 15 key factors to find the most secure messaging app!
• Explore the Android File system hierarchy in-depth:
• 9 new fake apps on the play store which can hijack SMS notification to carry out billing fraud
• 4 types of Attacks on the Tor Network to de-anonymize Tor users: