Mobile Malware · Real-World Cases · Lesson 1 of 5

The FluBot Outbreak

How one texted link turned victims' phones into a Europe-wide spam machine.

Anatomy of a self-spreading trojan

FluBot was an Android banking trojan active from late 2020 to mid 2022. You met it in Android App Security as the parcel text malware. Here we look at it the way an analyst would: what it did once installed, and why it spread so fast.

Researchers at Fox-IT (part of NCC Group), who tracked it version by version, report that the first samples appeared in Spain in November and December 2020. The security firm ThreatFabric published the first public analysis on January 6, 2021. Early texts pretended to come from couriers such as FedEx, DHL and Correos, Spain's postal service. In June 2021 a new lure arrived: a voicemail message asking you to install an app to listen to it. Later lures included a fake "Android Security Update" and a fake Flash Player.

After install, the app pushed the victim to switch on its accessibility service. Analysts at F-Secure and Cyble reported that FluBot then requested further permissions, such as reading SMS and contacts, and asked to become the phone's default SMS app. That gave it three main abilities:

• Overlays: fake login screens (researchers call them web injects) shown over banking and crypto apps to capture passwords.
• SMS theft: reading incoming texts, including one-time codes from banks.
• Sending texts: the phone itself could send messages.

That last ability was its spreading engine. F5 Labs describes a loop: the malware uploaded the victim's contact list to its server, downloaded a fresh list of numbers to target, and texted them the lure. Fox-IT notes the numbers came from a pool harvested from other victims, so a FluBot text could arrive from a total stranger as easily as from a friend. Every new victim was both a source of fresh numbers and a free sender.

Notice that FluBot didn't exploit any software bug. Every step needed the victim to tap, allow or approve something.

Evolution and the takedown

FluBot changed constantly. Fox-IT counted dozens of versions in about 18 months. Two changes matter most for analysts, because they were about staying reachable.

First, FluBot didn't hard-code one server address. It used a domain generation algorithm: both the malware and its operators could calculate the same long list of random-looking domain names for each month, and the operators only needed to register a few of them. Defenders who blocked one domain hadn't stopped anything. Fox-IT reports the list was cut from 5,000 to 2,500 domains a month in March 2021.

Second, from spring 2021 it looked up those domains using DNS over HTTPS, which sends name lookups inside ordinary encrypted web traffic to big public resolvers such as Google and Cloudflare. That made its lookups much harder for a network to spot or block. Later versions even tunneled their commands inside these lookups.

The campaigns also moved. After Spain came Germany and Hungary, then Belgium, Turkey, Romania and much of the rest of Europe, then Australia in mid 2021, then Japan, Hong Kong, South Korea, Singapore and Thailand in early 2022. Researchers also saw the network being used to deliver other banking trojans, such as TeaBot and Medusa.

On June 1, 2022, Europol announced that an operation involving law enforcement from 11 countries had taken FluBot down. The Dutch police led the technical part. In May 2022 they took control of FluBot's server infrastructure, which made the malware inactive. Dutch police said they disconnected about 10,000 victims from the network and prevented over 6.5 million spam texts. Europol said the hunt for the people behind it was still ongoing.

One lesson for defenders: a takedown cuts the criminals off, but it doesn't remove the app. Each infected phone still needed cleaning, and victims still needed to change passwords and check their bank accounts.