FutureFive New Zealand logo
Consumer technology news from the future
Story image

Scam Alert: Flubot malware hits New Zealand

By Shannon Williams
Thu 30 Sep 2021

The New Zealand telecommunications sector is warning customers of a new scam text message alert that is showing up in large numbers in New Zealand.

Pretending to be an alert from a courier company, the text asks users to click on a link or download an app to get information about delivery of a parcel.

Telecommunications Forum chief executive Paul Brislen says the link is not genuine and indications are that customers may find their personal details at risk if they do click on the link. 

"The payload appears to resend the text via the users address book and also asks for bank information. Needless to say at a time when everyone is using courier delivery services, this has the potential to cause a lot of damage," he says.

Customers who have already downloaded the app may need to restore their phone to basic factory settings in order to remove the malware and then change passwords to any apps you may have been logged in to at the time as a precaution.

"Anyone who receive the text message should just delete it," Brislen says. "Infection only occurs if the user clicks on the link or installs the app."

The TCF and the wider telco industry is working with the Department of Internal Affairs and CERT NZ to block the links to the malware. 

Researchers at NortonLifeLock have been tracking FluBot since it first began its spread across Europe in April 2021. 

The mobile malware infects and steals data from the phones of unsuspecting victims, which NortonLifeLock says highlights the importance of downloading comprehensive security to help keep devices and data safe. 

What is FluBot?

The malware of the moment, grabbing the headlines, is the aptly named FluBot. It's a banking trojan, which means it's designed to appear legitimate to the receiver. It sends SMS messages to unsuspecting targets, claiming that they missed a call or have a new voicemail, on some occasions impersonating well-known institutions, like trusted parcel delivery services or banks. Once someone unsuspectingly clicks on the link, they've unfortunately given FluBot access to their phone and data. Now installed, it will access all the personal information it can gather - passwords, banking information, credit card details and it can even steal the phones contacts details to spread to other phones.  

While mostly targeting Android devices, iOS users are not exempt from receiving a malicious FluBot SMS.The good thing: iOS apps can normally only be downloaded via the official Apple App store which makes it much harder for the malware to land on iPhones and iPads. Android users on the other hand need to be more careful as the app will install itself on phones that have enabled side loading, meaning that their owners allow the installation from apps outside of the Google Play store. 

How does FluBot work exactly? 

According to NortonLifeLock, the successful spread of this malware can be attributed to its distribution and timing, as a direct result of the impact of the COVID-19 pandemic on people's digital lives.         

The cyber criminals first step is to send a SMS to thousands of mobile devices. It could be an SMS advising that you've received a voicemail, detailing a specific time and date for the missed call and asking you to click the link to access the recording. The other common ruse is to encourage you to click a link so you can apparently see the location of your parcel. 

Due to COVID-19, more people than ever are using online shops to buy their goods, so receiving a parcel tracking link appears very plausible.          

The links and SMS are disguised to appear as though they come from a familiar and trusted company. However once clicked, they redirect the victim to a webpage. The webpage is designed to look legitimate to encourage the victim to believe they've been brought to the official company website. A popup prompt will appear and ask the victim to download and install an app. This is a malicious app and can be highly dangerous for your personal data. The disguised app will most likely ask for accessibility permissions, in order to grant itself even more permissions.        

At that point, the malicious app is now active, armed, and running in the background of the victims smartphone.   

It will now start doing the following:                    

  • Spreading further by accessing the phone's contact list                     
  • Gathering all the sensitive information it can get         

FluBot has yet another goal - monitoring which apps the victim opens. If it recognises a target app, the malware jumps into action by serving overlays that look like the real thing, but these are designed to collect the victims data. The final step is to send all the collected user details back to the cybercriminals. 

What can you do to help protect yourself against FluBot? 

NortonLifeLock says it is worth maintaining good mobile hygiene - keep your devices updated with the latest operating system, use strong passwords combined with multi-factor authentication and of course, use comprehensive security to help keep your devices and data safe. 

  • If you are on an Android device, disable Install Unknown Apps.A lot of malicious apps find their way on your phone outside of the official Google Play store, but from unknown sources. While it might be tempting to install the occasional app that you can't find in the official app store, if you're willing to take the risk and trust the source, make sure to disable the feature again afterwards, to reduce any ongoing security risk. 
  • Never open links that seem suspicious. Check to make sure that the mail is really from the sender it claims to be. If it promises things that seem to be too good to be true, they probably are. 
  • Don't grant apps broad permissions, only let them access what they need to function. Avoid any apps that ask for more data than necessary. As can be seen in the FluBot case, broad permissions can lead to the malware being able to perform their unwanted tasks and spread themselves further. 


Related stories
Top stories
Story image
Could New Zealanders initiate a cyber attack from within?
The threat landscape is significantly increasing worldwide, and the opportunities it presents are a growing concern in Aotearoa.
Story image
The path to bolstering supply chain security in New Zealand
A significant amount of today's business and leisure activity relies on IT supply chains. From complex international freight trades to local small business distribution channels, any supply chain that involves IT infrastructure serves as a crucial tool in our daily lives. 
Story image
Digital Transformation
SAP partners with New Zealand Rugby for digital transformation
The multi-year partnership will see SAP advance NZR with its organisational operations, team performance, fan experience and sustainability goals.
Story image
Microsoft NZ and TupuToa to boost diversity in cybersecurity sector
Microsoft NZ has teamed up with TupuToa to co-develop a cyber security employment programme specifically aimed at creating more diversity in Aotearoa's cybersecurity sector.
Story image
i-Pro announces newest solutions as rebranded enterprise
i-PRO APAC Oceania has introduced its newest high-resolution mid-range cameras, with combined edge AI analytics and resolutions of up to 4K.
Story image
Hands-on review: Amazon Kindle Paperwhite Signature Edition
In almost every respect it works like a book, apart from the fact that it weighs next to nothing, fits in my hand perfectly, and is soothing on my eyes.
Story image
WolfVision announces new range of visualisers
WolfVision has announced a new range of visualisers to help meet multiple industry demands for remote learning and educational solutions.
Story image
Hands-on review: MSI MPG Z690 Carbon WIFI motherboard
It’s all change with Intel’s 12th generation CPUs. We have a new chipset in the 600-series, a new socket with the LGA 1700, and new DDR5 memory.
Story image
i-PRO releases smallest AI-based surveillance camera on the market
The new i-PRO mini network camera is now available, with a pocket-sized form factor and full AI analytics functionality.
Story image
Chorus and Nokia launches first trial of 25G PON broadband
Chorus and Nokia have announced the successful demonstration of 25 gigabit per second fibre (Gbps) broadband technology at the Chorus Fibre Lab in Auckland. 
Story image
First Table
First Table set to revive restaurant commerce in NZ with platform launch
A new restaurant booking platform has launched in New Zealand, giving Kiwi diners the opportunity to save and book at a variety of restaurants around the country.
Story image
TUANZ to address rural connectivity at 2022 symposium
TUANZ is hosting the Rural Connectivity Symposium for the first time in person since 2019, providing a forum to discuss the state of rural connectivity.
Story image
PNY launches XLR8 Gaming EPIX memory products in A/NZ
PNY has launched its XLR8 Gaming EPIC-X RGB™ DDR4 Silver 3200MHz and 3600MHz memory products in Australia and New Zealand.
Story image
TikTok launches community-inspired effect capability
TikTok has announced the launch of its Effect House feature to allow its users to create and share Community Effects.
Story image
Hands-on-review: Creative Outlier Air V3
Creative is back with the third version of its affordable Outlier Air wireless earbuds range - aptly named the ‘V3’. And this time, they come boasting ambient mode and active noise reduction.
Story image
Microsoft backing Māori and Pacific wāhine in tech industry
A new initiative focused on getting Māori and Pacific wāhine into the tech industry and backed by Microsoft, NZTech and the government is calling for tech companies to get involved.
Story image
Hands-on review: HyperX Pulsefire Haste wireless mouse and HyperX Pulsefire XL Mat
With its lightweight Pulsefire Haste wireless mouse and RGB lit Pulsefire XL Mat, HyperX sets out to up your game and add a little colour to your desktop.
Story image
Digital Marketing
Getty Images delves into the world of NFTs with Candy Digital
Getty Images and Candy Digital, the next-generation digital collectible company, have announced a new multi-year partnership agreement.
Story image
Digital Signage
MAXHUB's Digital Signage range to bolster boardroom productivity
The new MAXHUB Digital Signage technology is purpose-built to make every kind of team meeting more effective.
Story image
Hands-on review: Technics EAH-A800 Noise Cancelling Wireless Headphones
Designed in Osaka, Japan, these headphones just exude quality. They aren’t heavy, but they feel well built and solid.
Story image
The AI Forum helps NZ pave the way with AI sustainability practices
Non-profit organisation The AI Forum is helping Kiwis learn about addressing climate change issues through the use of AI technology.
Story image
Hands-on review: Corsair 32GB Vengeance 5200MHz DDR5 DRAM kit
Corsair’s Vengeance 5200MHz DDR5 DRAM offers PC users an entry-level upgrade to the new memory standard allowing them to get a little bit more out of their new Alder Lake CPUs.
Story image
Hands-on review: 32GB PNY XLR8 Gaming MAKO 6000MHz DDR5 memory kit
PNY’s XLR8 Gaming MAKO DDR5 memory modules are designed to get the most out of systems based on Intel’s 12th generation Alder Lake CPUs.
Story image
D-Link launches new G415 Smart Router as part of EAGLE PRO AI range
D-Link A/NZ has announced the launch of its new G415 AX1500 4G Smart Router as part of the new EAGLE PRO AI Series.
Story image
Tyson Beckford partners with Element Case on new AppleWatch band
Celebrity Tyson Beckford has collaborated with STM Brands' Element Case brand to create a rugged new accessory.
Story image
Hands-on review: Steelseries Aerox 9 Wireless and Aerox 5 gaming mice
Steelseries offered two interesting mice for review, the Aerox 9 Wireless, aimed at MMO/MOBA players, and the Aerox 5, a wired mouse for multi-genre use.
Story image
Jabra reveals its latest portable headset Engage 55
Jabra has launched the Engage 55, the newest product in Jabra's Engage series designed for ultimate call security and quality.
Story image
Microsoft unveils adaptive accessories for disability access
Microsoft is introducing an expansive Inclusive Tech Lab to give people with disabilities greater access to technology through new software features and adaptive accessories.
Story image
Artificial Intelligence
Google to enter the smartwatch market with the Google Pixel Watch
Google has provided a first look at its new Google Pixel Watch, which is set to make an entry into the competitive smartwatch market.
Story image
IDC finds 3.9% decline in worldwide tablet shipments
Preliminary data from IDC's Worldwide Quarterly Personal Computing Device Tracker has found tablet shipments reached 38.4 million units during Q1 2022, a year-over-year decline of 3.9%.
Story image
WhatsApp and QR codes the next scam threat - report
KnowBe4 has warned it expects to see an increase in QR Codes and the WhatsApp chat platform being used for phishing and other scams. 
Story image
Sony launches LinkBuds S - the latest model in the series
Sony says the LinkBuds S will give users a unique sound experience through sensor and spatial sound technology, even in AR games.
Story image
Wireless Nation
Wireless Nation, N4L provide 4G network to remote NZ schools
Wireless Nation and Network for Learning (N4L) have rolled out the Rural Connectivity Group’s (RCG) new 4G network to better connect three Chatham Islands schools.
Story image
Hands-on review: Norton Anti Track 19 software
We get hands on with Norton's new privacy tool that was introduced in March 2022.
Story image
Apple previews new features for users with disabilities
Apple says new software features that offer users with disabilities new tools for navigation, health and communication, are set to come out later this year.
Story image
Hands-on review: WD_Black SN770 NVMe SSD Game Drive
Western Digital expands its WD_Black range of NVMe solid-state drives with the WD_Black SN770 Game Drive.
Story image
Mastercard users can now use rewards points in gaming
Mastercard has launched Mastercard Gamer Xchange (MGX), allowing APAC consumers to convert their rewards points into gaming currency.
Story image
Hands-on-review: GoPro Hero 10
I have a long history with GoPro; I still remember getting my first camera when I was 16, using it to film Parkour and the day I lost it down a dingey crag. 
Story image
Dynabook launches new Tecra A40-K and A50-K models
Dynabook has announced two new additions to its Tecra range, with both said to help promote flexible working solutions while also reducing the strain on IT managers.
Story image
Hands-on review: STM laptop bags
The advent of hybrid working has meant we need laptop bags. We got our hands on two of the most popular laptop bags from STM.
Story image
New digital traffic light system to tackle construction defects
Smarter Defects Management launches its PaaS digital system and says it will revolutionise managing defects in the construction industry.
Story image
Poly introduces new smart devices and announces Amazon e-store in Australia
Poly is introducing two new pro-grade devices to the market and announcing its first official Australian e-store on Amazon.
Story image
Logitech releases new mouse with ergonomic and sustainable focus
Logitech has announced the Logitech Signature M650 Mouse and the Signature M650 for Business Wireless Mouse, both with new ergonomic features and capabilities.
Story image
Dynabook refreshes Portégé X30L series with the Portégé X30L-K
The new model contains hybrid-architecture Intel 12th Gen Core P-Series 28W processor options, Wi-Fi 6E, along with Intel Iris Xe graphics.