apk.fluhorse (Back to overview)


According to Check Point, this malware features several malicious Android applications that mimic legitimate applications, most of which have more than 1,000,000 installs. These malicious apps steal the victims’ credentials and Two-Factor Authentication (2FA) codes. FluHorse targets different sectors of Eastern Asian markets and is distributed via emails. In some cases, the emails used in the first stage of the attacks belong to high-profile entities. The malware can remain undetected for months making it a persistent, dangerous, and hard-to-spot threat.

2023-06-23Medium (Cryptax)Axelle Apvrille
@online{apvrille:20230623:inside:80ab43b, author = {Axelle Apvrille}, title = {{Inside KangaPack: the Kangaroo packer with native decryption}}, date = {2023-06-23}, organization = {Medium (Cryptax)}, url = {}, language = {English}, urldate = {2023-06-26} } Inside KangaPack: the Kangaroo packer with native decryption
2023-06-21FortinetAxelle Apvrille
@online{apvrille:20230621:fortinet:d3403aa, author = {Axelle Apvrille}, title = {{Fortinet Reverses Flutter-based Android Malware “Fluhorse”}}, date = {2023-06-21}, organization = {Fortinet}, url = {}, language = {English}, urldate = {2023-06-26} } Fortinet Reverses Flutter-based Android Malware “Fluhorse”
2023-05-04Check Point ResearchAlex Shamshur, Sam Handelman, Raman Ladutska
@online{shamshur:20230504:eastern:30d81b9, author = {Alex Shamshur and Sam Handelman and Raman Ladutska}, title = {{Eastern Asian Android Assault - FluHorse}}, date = {2023-05-04}, organization = {Check Point Research}, url = {}, language = {English}, urldate = {2023-05-10} } Eastern Asian Android Assault - FluHorse

There is no Yara-Signature yet.