Flubot Smishing

Overview

Across Europe, mobile users are being targeted with a mobile phishing campaign that delivers the FluBot banking trojan. FluBot first made headlines when in early 2021 when it was using the guise of validating or providing updates about shipments from Deutsche Post & DHL, Saturn, UPS and others. Since then, it has come up every couple of months, most recently masquerading as an Adobe Flash app that users need to download.

When Android users that tap the link, they’re brought to a page where they are told to download an app, which is infected with FluBot, to track the package. Once the app is

installed, it can intercept and send SMS messages, display screen overlays, and steal contacts. iOS users are directed to phishing pages that link to other malware or impersonate major banks in hopes of stealing that user's mobile banking login credentials.

‍

Lookout Analysis

Lookout data shows that in 2021, about 70% of mobile phishing attacks targeting both consumer and enterprise users intended to deliver malware like FluBot. This exemplifies how problematic Malware-as-a-Service (MaaS) like FluBot can be. As we’ve seen with FluBot popping up so frequently, MaaS makes it easy for attackers to reskin and redeliver an existing piece of malware.

FlubBot employs a domain generation algorithm (DGA), which creates slightly different variations of a given domain name in a tactic known as domain fluxing. This is similar to hiding the needle (the true Command & Control server IP) in a haystack (a long list of IPs).