A huge wave of the Flubot malware has been making its rounds in the wild, primarily targeting users in Europe -- particularly the UK -- and in the US.
Flubot is an Android banking malware which lures victims to install the app, eventually stealing victim's bank credentials. Flubot has a complete list of capabilities, but features overlay attack capabilities most prominently. It also holds capability to bypass financial institutions' multi-factor authentication security features.
According to Threatpost,
“The U.K.’s National Cyber Security Centre (NCSC) has issued security guidance about how to identify and remove FluBot malware, while network providers including Three and Vodafone have also issued warnings to users over the text message attacks”.
Flubot's infection cycle starts with an SMS message luring victims by stating they have either missed their parcel or a new parcel is arriving. The SMS message contains a malicious link, which redirects users to a compromised website that downloads an Android banking malware.
|Figure 1 : Flubot Smshing Link (src:https://twitter.com/VodafoneUK/status/1385326486144618497)|
The downloaded app, Flubot, portrays itself as one of the delivery apps from either “Fedex,” “DHL”, or “Correos”. And in some cases, as “Chrome”.
|Figure 2 : Malware Icons|
Flubot is a typical Android Banking malware, which consists of following key features:
- Steals SMS messages
- Steals Contacts
- Spreads itself by messaging to contact list
- Reads notifications
- Gets list of installed applications
- Uses Accessibility Services
- Deletes apps from compromised device
- Performs calls
- Steals Credit Card information using fake system overlays
Some of the unique features include using Domain Generation Algorithm (DGA) to contact command and control (C&C) servers and encrypting part of the communication sent to C&C servers using RSA encryption. It can also disable Google Play Protect via Android’s Accessibility feature.
Once installed, the malware keeps a watch on the application opened by the victim. If the app turns out to be one of the targeted banking apps, it shows a fake overlay screen to the victim and eventually steals credentials.
Flubot also has the capability to steal credit card information by displaying a fake Google verification page.
|Figure 3 : Credit Card Theft|
In-depth analysis of Flubot malware was done by Prodaft and can be found here (pdf)
Zscaler’s Defense-In-Depth approach prevents the infection at each step, eventually bringing down the complete attack kill-chain. References to Zscaler Threat Library and Flubot definitions can be found here.
As seen in the screenshot below, Zscaler’s advanced sandbox detects all the Flubot variants with utmost precision.
|Figure 4 : Zscaler Cloud Sandbox Detections.|
Due to the ubiquitous nature of the Android operating system, attacks on its users are inevitable and will keep increasing at a rapid pace. Android users should always be wary of the presence of mobile malware.
Malware such as Flubot have full potential to compromise victims with features like stealing banking credentials and bypass multi-factor security measures.
It is always advisable to stay away from third-party sources distributing Android apps, and to distrust any random links presented to you via email and/or SMS messages.
Zscaler customers are protected from such types of attacks. The Zscaler Security team, ThreatLabZ, provides proactive coverage against advanced threats targeting Android banking apps, such as Flubot.
ThreatLabz also tracks various Android malware families along with advanced APT (Advanced Persistent Threats) pertaining to Android ecosystem and ensures coverage for all the latest malicious indicators.