FluBot
MITRE ATT&CK: S1067 View on attack.mitre.org
Aliases: Cabassous, FakeChat, FluBot
- First seen
- 2020-11-01 00:00:00
- Malware type
- trojan, credential-stealer, botnet
- Family
- Malware family
- Operating systems
- android
- Related IoCs
- 210 (131 malicious)
- Last IoC activity
- 2026-10-18 03:21:23
- Profile updated
- 2026-07-07 13:52:06
Targeted industries: financial-services retail-and-hospitality technology-and-telecommunications
Targeted regions: country_code:es country_code:de country_code:uk country_code:fi country_code:dk
Context
FluBot is a multi-purpose mobile banking malware that was first observed in Spain in late 2020. It primarily spread through European countries using a variety of SMS phishing messages in multiple languages. An international law enforcement operation of 11 countries eventually disrupted the spread of FluBot.
Recent IoC activity
131 malicious indicators in Maltiverse are attributed to FluBot (S1067). The 20 most recently updated:
Malware & tools used
- SMS Control (attack-pattern)
- Domain Generation Algorithms (attack-pattern)
- Contact List (attack-pattern)
- Disable or Modify Tools (attack-pattern)
- Stored Application Data (attack-pattern)
- Obfuscated Files or Information (attack-pattern)
- GUI Input Capture (attack-pattern)
- Phishing (attack-pattern)
- Proxy Through Victim (attack-pattern)
- Web Protocols (attack-pattern)
- User Evasion (attack-pattern)
- Abuse Accessibility Features (attack-pattern)
- SMS Messages (attack-pattern)
- Exfiltration Over C2 Channel (attack-pattern)
- Asymmetric Cryptography (attack-pattern)
- Access Notifications (attack-pattern)
- Prevent Application Removal (attack-pattern)
Reports & references
- blog.cyble.com — Flubot Variant Masquerading As The Default Android Voicemail App (report)
- info.spamhaus.com — Q4%202023%20Botnet%20Threat%20Update (report)
- blog.fox-it.com — Flubot The Evolution Of A Notorious Android Banking Malware (report)
- twitter.com — 1404098461440659459 (report)
- twitter.com — 1402615237296148483 (report)
- news.netcraft.com — Flubot Malware Spreads To Australia (report)
- cryptax.medium.com — Android Flubot Preparing For A New Campaign 2F7563Fc6C06 (report)
- securityintelligence.com — Story Of Fakechat Malware (report)
- f5.com — Flubots Authors Employ Creative And Sophisticated Techniques To Achieve Their Goals In Version 50 And Beyond (report)
- therecord.media — Despite Arrests In Spain Flubot Operations Explode Across Europe And Japan (report)
- ncsc.admin.ch — 22W12 De (report)
- cert.govt.nz — Parcel Delivery Text Message Infecting Android Phones (report)
- therecord.media — Flubot Malware Gang Arrested In Barcelona (report)
- twitter.com — 1399249798063087621 (report)
- nortonlifelock.com — Flubot Targets Android Phone Users (report)
- raw.githubusercontent.com — Flubot (report)
- twitter.com — 1384840011892285440 (report)
- bitsight.com — Flubot Malware Persists Most Prevalent Germany And Spain (report)
- medium.com — A Look At An Android Bot From Unpacking To Dga E331554F9Fb9 (report)
- news.netcraft.com — Resurgent Flubot Malware Targets German And Polish Banks (report)
- mobile.twitter.com — 1400396365759500289 (report)
- securityblog.switch.ch — Android Flubot Enters Switzerland (report)
- infinitumit.com.tr — Flubot Zararlisi (report)
- info.spamhaus.com — 2023%20Q1%20Botnet%20Threat%20Update (report)
- twitter.com — 1359939300238983172 (report)