Getting strange SMS messages? Here’s how to avoid the Flubot
If you’ve been receiving some strange, garbled SMS messages mentioning a missed call or voicemail recently, you’re not alone. The messages are generated by malware called Flubot, which spreads via SMS and can infect insecure Android phones.
Since August 2021, many Australians have been getting scam text messages about missed calls, voicemails or deliveries. We’ve received over 12,000 reports of these scams. These scams have also already been a problem overseas in 2021.
The text messages ask you to tap on a link to download an app to track or organise a time for a delivery, or hear a voicemail message However, the message is fake, there is no delivery or voicemail, and the app is actually malicious software called Flubot.
Android phones and iPhones can both receive texts from the Flubot.
* If you receive one of these messages, do not click or tap on the link. Delete the message immediately.
What the scam messages look like
Delivery notifications
Starting in September 2021, many Flubot messages now talk about a delivery. They usually refer to DHL and always ask you to take some form of action in relation to the ‘delivery’. We have also started to see reports referring to Amazon deliveries.
Messages can include:
- scheduling a delivery time
- tracking a delivery
- managing a delivery that is ‘in transit’ or will be ‘delivered soon’
- telling you it’s your last chance to arrange pick up/delivery of a parcel
- asking you to enter your details to receive a package
- getting ‘more information’ about your delivery.
Unlike earlier Flubot messages (which are also still circulating), the new text messages may not contain spelling mistakes, so they can be harder to spot. However, they do contain a website link followed by 6-8 random letters and numbers. Here are some examples:
- The delivery time for your parcel is 03/09. Check out your options: http://example.com/g.php?l2r54ya alfal
- Your DHL order ID1842225 will arrive soon. Track progress here
- Your order will be delivered by DHL tomorrow between 11:26 and 14:26. Track progress https://example.com/n.php?la4pmtf6u yewv
- You have (1) Pending Package! Ref: DHL-6461W Last chance to PICK it up > https://www.example.com/t.php?kdnypf0ng0
- You must enter your details 2cc receive your package with DHL https://www.crabsunion.com/0axazu.php?gdk642k
- ARRIVAL today: your Amazon package. More INFO at http://example.com/n.php?la8zvtf0u
- Arriving today: your (d08) Amazon {s7} package. More info at https://example.com/n.php?ps7gxif4s
Voicemail & missed call notifications (August 2021)
Missed call and voicemail messages started circulating in Australia in August 2021. They often begin with 5-6 random lowercase letters or numbers, then say you had a missed call or voicemail message.
The text message often includes several misspellings. Here are some examples.
- ab12c3 Nfw voice yessage received
- gh6tr7 Voicemail message receiied
- x78y9z New oozce-message received
After saying you have a missed call, voicemail or message, the messages include a link. The message may also say the voicemail message will be automatically deleted if you don’t access it.
What happens if you click or tap the link
Clicking/tapping the link could lead to downloading malware (malicious software) to your phone.
What to do if you’ve downloaded the Flubot
ACT IMMEDIATELY. If you have already clicked the link to download the application, your passwords and online accounts are now at risk from hackers.
Don’t enter any passwords or log into any accounts until you have followed the below steps. If you need to check your online banking, use a different device to do so.
Clean your device
Cleaning your device using the steps below will remove the malicious software from your device.
To clean your device, you can:
- contact an IT professional
- download official Android anti-virus software through the Google Play Store
- perform a factory reset of the device, as soon as possible.
The best way to make sure that your phone is clean is to use the ‘Erase all Content and Settings’ or ‘Factory reset’ features. The exact name of the feature will depend on the device you have. Performing this reset of your device will delete all of your data including photos, messages, and authentication applications.
When performing a factory reset it’s important that you don’t restore from any backups created after you downloaded the app, as they will be infected.
Change your passwords and secure your information
If you have logged in to any accounts or apps using a password since downloading the app, you need to change your passwords.
If you have used the same passwords for any other accounts, you also need to change those passwords.
Contact your bank and ensure your accounts are secure.
Australian Competition & Consumer Commission: https://www.scamwatch.gov.au/news-alerts/missed-delivery-call-or-voicemail-flubot-scams