According to Check Point, this malware features several malicious Android applications that mimic legitimate applications, most of which have more than 1,000,000 installs. These malicious apps steal the victims’ credentials and Two-Factor Authentication (2FA) codes. FluHorse targets different sectors of Eastern Asian markets and is distributed via emails. In some cases, the emails used in the first stage of the attacks belong to high-profile entities. The malware can remain undetected for months making it a persistent, dangerous, and hard-to-spot threat.
|2023-06-23 ⋅ Medium (Cryptax) ⋅ |
Inside KangaPack: the Kangaroo packer with native decryption
|2023-06-21 ⋅ Fortinet ⋅ |
Fortinet Reverses Flutter-based Android Malware “Fluhorse”
|2023-05-04 ⋅ Check Point Research ⋅ |
Eastern Asian Android Assault - FluHorse
There is no Yara-Signature yet.