Europol announced on Wednesday the shutdown of the FluBot operation, one of the largest and fastest-growing Android malware operations in existence.
The malware operation’s takedown resulted from a law enforcement operation involving 11 countries following a complex technical investigation in order to locate FluBot’s most critical infrastructure.
The participants in the operation included Australia, Belgium, Finland, Hungary, Ireland, Spain, Sweden, Switzerland, the Netherlands, and the United States.
“Known as FluBot, this Android malware has been spreading aggressively through SMS, stealing passwords, online banking details, and other sensitive information from infected smartphones across the world. Its infrastructure was successfully disrupted earlier in May by the Dutch Police (Politie), rendering this strain of malware inactive,” said Europol in its announcement.
The Dutch Police also announced on Wednesday that they have disconnected ten thousand victims from the FluBot network and prevented over 6.5 million spam SMS from reaching potential victims.
In March 2021, the police in Spain arrested four suspects who were considered key members of the FluBot operation, since the malware had mainly infected users in the region.
After a brief hiatus, the malware returned at very high levels and targeted multiple other countries besides Spain.
According to Europol, however, the FluBot infrastructure is currently under the control of law enforcement, so there can’t be any rebound.
FluBot
FluBot is an Android malware that steals banking and cryptocurrency account credentials by overlaying phishing pages on top of the interface of legitimate apps when victims open them.
It also can access SMS content and monitor notifications in order to take two-factor authentication and OTP codes.
Methods of distribution for the malware include laced apps on the Google Play Store, fraudulent parcel delivery messages, Flash Player app updates, and many more.
For anyone that believes that FluBot infected their device, Europol suggests they perform a factory reset that wipes all data in the areas that can host malware.