FluHorse
- First seen
- 2023-04-01 00:00:00
- Malware type
- credential-stealer, trojan
- Family
- Malware family
- Profile updated
- 2026-07-07 14:06:35
Targeted industries: financial-services technology-and-telecommunications retail-and-hospitality
Targeted regions: country_code:cn country_code:tw country_code:hk country_code:jp
Context
According to Check Point, this malware features several malicious Android applications that mimic legitimate applications, most of which have more than 1,000,000 installs. These malicious apps steal the victims’ credentials and Two-Factor Authentication (2FA) codes. FluHorse targets different sectors of Eastern Asian markets and is distributed via emails. In some cases, the emails used in the first stage of the attacks belong to high-profile entities. The malware can remain undetected for months making it a persistent, dangerous, and hard-to-spot threat.
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Apk.Fluhorse (report)
- cryptax.medium.com — Inside Kangapack The Kangaroo Packer With Native Decryption 3E7E054679C4 (report)
- fortinet.com — Fortinet Reverses Flutter Based Android Malware Fluhorse (report)
- research.checkpoint.com — Eastern Asian Android Assault Fluhorse (report)