MALWARE has become a serious concern for users globally as they steal sensitive information from users' devices without letting them know. In a new research, a new Android malware has been found that is reportedly targeting eastern Asia with the help of malicious applications which seems genuine at first as they have over 1 lakh installs.

According to a study by Check Point, these apps are made in such a way that they may extract important data, including passwords and even Two-Factor Authentication (2FA) codes, which are seen by users as the safest option when it comes to security.

FluHorse: How It Is Distributed?

Like all malware, it can infect your system, but only with a tap. However, it has been discovered that emails are used to spread malware, in Eastern Asia specifically. At the beginning of the phishing email attack, high-profile targets like public figures were occasionally targeted. The potential of FluHorse to go unnoticed for extended periods of time makes it a persistent and serious threat that is challenging to identify, which is one of the most worrying elements of the virus.

In simple terms, FluHorse attacks begin with targeted, malicious emails that are sent to prominent people and implore them to act right away to fix an alleged payment issue.

How Does FluHorse Work?

Typically, a hyperlink in the email directs the target to a phishing website. They are then instructed to download the phoney APK (Android package file) of the fake application once they arrive. 'ETC,' a Taiwanese toll collection app, and 'VPBank Neo,' a Vietnamese banking app, are both imitated by the FluHorse carrier apps.

Both of these apps' legal versions have received over a million downloads on Google Play. According to the report, all three of the fake apps ask for SMS access after installation in order to intercept incoming 2FA codes in case those codes are needed to compromise the accounts.

FluHorse: How To Identify Its A Threat?

The fake apps closely resemble the genuine user interfaces, but they are limited to two to three windows that load forms and collect the victim's data. The apps display a "system is busy" message for 10 minutes after capturing the victims' account credentials and credit card information to make the process seem realistic. In the meantime, the operators are working in the background to intercept 2FA codes and use the stolen data.

(With Agency Inputs)