Loading malware…
FlokiBot is a Windows banking malware family associated with underground cybercrime activity and referenced alongside other Zeus-derived banking trojans. It has been discussed in criminal forums by its vendor and has been linked operationally to botnet infrastructure later used to distribute other malware, including point-of-sale malware targeting Brazilian organizations. Observed reporting indicates that a FlokiBot botnet was used to deliver LockPoS, suggesting that operators behind FlokiBot maintained broader malware distribution capability beyond banking fraud alone.
High-confidence public reporting in the supplied material does not provide a full technical profile of FlokiBot itself, but it does establish its role as a botnet-enabled malware family active in financially motivated ecosystems. Its association with banking-trojan lineages and criminal-market competition indicates use in credential-focused financial crime operations. FlokiBot has also been connected to campaigns affecting point-of-sale environments in Brazil through shared infrastructure and distribution activity, indicating overlap between banking malware operations and retail payment-card theft targeting.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Flokibot is described as the botnet used to distribute LockPoS and was previously seen targeting PoS systems in Brazil.
Banking malware mentioned only as historical background.
...Daniel Inzirillo FlokiBot GitHub Gosya...
A competing banking trojan mentioned because its vendor challenged the seller of Nuclear Bot on underground forums.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.