Loading story…
Finland's National Cyber Security Centre warned that FluBot is again being spread through fraudulent mobile messages targeting Android users, with the latest wave using both SMS and MMS lures. The campaign follows earlier voicemail- and parcel-themed scam texts that directed recipients to malicious links and attempted to trick them into installing an Android .apk outside official app stores. Authorities said iPhone and other non-Android users may still be exposed to subscription traps, phishing pages, and other scams even if the malware itself does not infect their devices.
FluBot targets Android devices with mobile subscriptions and can steal data, send additional scam texts, and generate international SMS traffic from compromised phones. Officials stressed that opening the link alone does not install the malware; infection requires the user to approve installation. Users were told not to open links in suspicious messages or install apps from unofficial sources, and those who have already installed the malware were urged to act immediately, with a factory reset identified as the fastest remediation step.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Finnish authorities warned that FluBot was again being distributed through fraudulent mobile messages, including both SMS and a newer MMS-based wave. The campaign targeted Android users, while users of other devices could be redirected to subscription traps or other scams instead of receiving the malware itself.
The later 2022 advisory states that FluBot message campaigns had previously been seen in Finland in December 2021, marking the last known activity before the new resurgence. This indicates the campaign remained active in Finland at least through late 2021.
The Finnish National Cyber Security Centre published an alert about scam text messages claiming the recipient had a new voicemail and urging them to follow a link. Users were warned not to click the links because they could lead to malware, phishing pages, or subscription traps.
Finland's National Cyber Security Centre reported an SMS scam campaign themed around package deliveries that attempted to trick Android users into installing the FluBot malware via an APK file. The malware could steal data and send additional scam and international SMS messages from infected devices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
FluBot emerged as a large Android banking malware operation that spread through **smishing** messages impersonating parcel delivery, voicemail, WhatsApp, and security-update themes, luring users to install malicious APKs from fake or hacked websites. Researchers reported that the malware abused Android **Accessibility Services** and SMS privileges to disable protections, steal banking credentials and card data through overlays, intercept verification codes, harvest contacts, and self-propagate by sending large volumes of text messages; Deutsche Telekom said infected devices sent about 1,000 SMS per day on average, with some reaching 3,000. Analysis from multiple firms also found encrypted or obfuscated payloads, **DGA**-based infrastructure discovery, rotating domains, and evolving command-and-control techniques, while some campaigns additionally delivered other malware families including **TeaBot** and **Medusa**. The campaign heavily affected Spain and later expanded across Europe and beyond, with reports linking it to at least **60,000 infected devices**, roughly **11 million harvested phone numbers**, and tens of thousands of spam SMS messages. Catalan police arrested four suspects in Barcelona tied to the operation, including an alleged malware author, but FluBot activity continued after those arrests and kept evolving through new variants such as voicemail-themed samples and country-specific campaigns. A broader international law-enforcement effort later disrupted the botnet’s infrastructure, with Europol announcing a coordinated takedown after action led in part by Dutch authorities, although researchers warned the operators could attempt to rebuild using new domains and servers.
Aug 15, 2026
Threat actors used **COVID-19-themed lures** to push Android malware through SMS phishing and unofficial download sites, targeting users with fake alerts, safety tools, and public-health claims. Proofpoint reported that the **TangleBot** campaign sent text messages in the United States and Canada themed around coronavirus information and power outages, directing Android users to links that served a malicious APK and a fake **Adobe Flash Player** update prompt. Separately, researchers documented a fake **"Corona Safety Mask"** app and similar coronavirus-themed Android packages that were distributed outside official app stores and promoted through deceptive websites and messages. Once installed, the malware gave operators extensive access to infected devices. TangleBot supported surveillance and device control features including **keylogging, SMS and call control, screen capture, camera and microphone access, GPS tracking, clipboard access, and overlay injection**, while using obfuscation and Telegram-based command-and-control discovery to hinder analysis. The other Android trojan focused on propagation by requesting permission to read contacts and send SMS messages, harvesting address books and sending malicious texts with download links to additional victims; researchers also warned the app appeared capable of evolving toward broader fraud or theft functions.
Aug 15, 2026
Researchers reported that monetized URL shortener services and fake download pages were used to push **Android/FakeAdBlocker** and other malicious Android apps disguised as ad blockers or popular applications. Victims were funneled through aggressive advertising chains and prompted to install APKs with misleading names such as `adBLOCK app.apk`, after which the malware hid its icon, contacted command-and-control infrastructure, and fetched additional payloads. ESET said the campaign generated more than **150,000** Android downloads in the first half of 2021, while iPhone users were steered into fraudulent calendar-subscription scams rather than direct malware installs. The Android infections did not stop at adware. Researchers said the delivery chains also deployed banking trojans including **Cerberus**, **Ginp**, and **TeaBot**, alongside SMS trojans and other payloads, making the outcome dependent on the victim's region and the operators' current configuration. Separate reporting on Cerberus and Ginp described both as mobile banking malware families, and Bitdefender documented similar lures using mockups of well-known apps to spread **TeaBot** and **FluBot**, underscoring a broader ecosystem in which deceptive mobile install flows are used to distribute credential theft, financial fraud, and messaging abuse malware on Android.
Aug 14, 2026