Loading story…
Check Point Research reported an ongoing Android malware campaign dubbed FluHorse that targets Eastern Asian markets, particularly users in Taiwan and other Chinese-speaking communities. The malware is delivered through phishing emails and lookalike domains that impersonate trusted organizations, including Far Eastern Electronic Toll Collection Co., Ltd., with infrastructure such as fetc-net[.]com used to lure victims into installing malicious apps disguised as legitimate services.
Once installed, the fake applications harvest account credentials, payment card details, and SMS messages used for two-factor authentication, enabling attackers to bypass SMS-based security controls. Researchers said the malware family was built largely with Flutter, which complicated reverse engineering and helped it evade detection for an extended period, and traced the activity back to May 2022 with new malicious apps and infrastructure continuing to appear on a monthly basis.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Fortinet analyzed a June 2023 FluHorse Android sample that used a native loader and AES-128-CBC to decrypt an embedded payload before loading a secondary DEX, showing an evolution from earlier May 2023 samples that were not packed. The sample masqueraded as an electronic toll app, stole credentials, and intercepted SMS 2FA codes, with the sample first seen on June 11 and accessed from Asia beginning June 12.
Check Point Research traced the FluHorse Android malware campaign back to May 2022. The operation used phishing emails, lookalike domains, and malicious apps impersonating trusted transportation, banking, and dating services to steal credentials, payment card data, and SMS-based 2FA codes.
Check Point Research disclosed FluHorse as a newly discovered Android malware family affecting Eastern Asian markets. The report detailed its use of Flutter-based malicious apps, phishing-style credential theft, and SMS interception capabilities, and said the campaign was ongoing with new infrastructure and apps appearing monthly.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 52 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
FluBot emerged as a large Android banking malware operation that spread through **smishing** messages impersonating parcel delivery, voicemail, WhatsApp, and security-update themes, luring users to install malicious APKs from fake or hacked websites. Researchers reported that the malware abused Android **Accessibility Services** and SMS privileges to disable protections, steal banking credentials and card data through overlays, intercept verification codes, harvest contacts, and self-propagate by sending large volumes of text messages; Deutsche Telekom said infected devices sent about 1,000 SMS per day on average, with some reaching 3,000. Analysis from multiple firms also found encrypted or obfuscated payloads, **DGA**-based infrastructure discovery, rotating domains, and evolving command-and-control techniques, while some campaigns additionally delivered other malware families including **TeaBot** and **Medusa**. The campaign heavily affected Spain and later expanded across Europe and beyond, with reports linking it to at least **60,000 infected devices**, roughly **11 million harvested phone numbers**, and tens of thousands of spam SMS messages. Catalan police arrested four suspects in Barcelona tied to the operation, including an alleged malware author, but FluBot activity continued after those arrests and kept evolving through new variants such as voicemail-themed samples and country-specific campaigns. A broader international law-enforcement effort later disrupted the botnet’s infrastructure, with Europol announcing a coordinated takedown after action led in part by Dutch authorities, although researchers warned the operators could attempt to rebuild using new domains and servers.
Aug 15, 2026
Attackers have been running an Android malware campaign against customers of eight Malaysian banks by posing as local businesses, including cleaning services and a pet store, through fake e-commerce websites promoted with Facebook ads and lookalike domains. Victims who click bogus Google Play download buttons on the copycat sites receive malicious Android apps hosted on attacker-controlled servers rather than the official app store. The malware steals online banking credentials by presenting a fake **FPX** payment page and then intercepts two-factor authentication by forwarding all incoming SMS messages to the attackers. ESET linked several of the malicious apps to the same threat actor through shared code and said the operation, first spotted in late 2021, was still active with newly registered distribution domains.
Aug 14, 2026
Researchers reported that monetized URL shortener services and fake download pages were used to push **Android/FakeAdBlocker** and other malicious Android apps disguised as ad blockers or popular applications. Victims were funneled through aggressive advertising chains and prompted to install APKs with misleading names such as `adBLOCK app.apk`, after which the malware hid its icon, contacted command-and-control infrastructure, and fetched additional payloads. ESET said the campaign generated more than **150,000** Android downloads in the first half of 2021, while iPhone users were steered into fraudulent calendar-subscription scams rather than direct malware installs. The Android infections did not stop at adware. Researchers said the delivery chains also deployed banking trojans including **Cerberus**, **Ginp**, and **TeaBot**, alongside SMS trojans and other payloads, making the outcome dependent on the victim's region and the operators' current configuration. Separate reporting on Cerberus and Ginp described both as mobile banking malware families, and Bitdefender documented similar lures using mockups of well-known apps to spread **TeaBot** and **FluBot**, underscoring a broader ecosystem in which deceptive mobile install flows are used to distribute credential theft, financial fraud, and messaging abuse malware on Android.
Aug 14, 2026