FluBot Malware: The Android Threat Spreading Through Text Messages

Last updated: October 15, 2026

A malware strain called FluBot is targeting Android users through text messages, stealing credentials and spreading to contacts. Security researchers first spotted it in late 2020, and since then it has traveled from Europe to Australia and New Zealand.

The scam works through SMS messages that claim to contain delivery updates, voicemails, or software alerts. Each message includes a link that, if tapped, downloads malware instead of the promised content.

At a Glance

• FluBot arrived in late 2020, affecting Android devices in Spain first before spreading through Europe in early 2021
• Android holds roughly 70 percent of the global smartphone market, making it an attractive target
• UK authorities identified thousands of infected devices by mid-2021, with tens of thousands of malicious texts sent every hour
• Australian fraud watchers received over 16,000 reports of FluBot scams within a few months
• Once infected, the malware steals passwords, financial details, and contacts
• No security software currently removes FluBot; factory reset is the only fix

How FluBot Gets Into Your Phone

The malware spreads exclusively through SMS. Attackers send messages that look like notifications from trusted brands or services. Common disguises include fake delivery tracking links, voicemail alerts, software update prompts, and phony photo album invitations.

The social engineering plays on urgency. Recipients are told a package awaits, their voicemail is full, or their device needs an immediate update. The goal is to make someone tap without thinking.

Tapping the link does not immediately harm your phone. You must actively download and install the offered software. The catch? The download is malware, not the promised app.

Both Android and iPhone users can receive these messages, but only Android devices can be infected. This is because Android allows installing apps from outside the official app store, which is exactly what FluBot requires.

What Happens After Infection

After installation, FluBot gives attackers broad control over your device. They can steal login credentials and credit card numbers stored on the phone. The malware also disables built-in security features, both from Android and any third-party protection you installed.

Perhaps most concerning, FluBot accesses your contact list and sends copies of itself to everyone you know. It then blocks replies to those messages, preventing recipients from verifying the sender.

Another dangerous capability: interception of SMS messages from banks. This includes one-time passwords and verification codes needed to confirm money transfers. With these codes, attackers can authorize transactions while you remain unaware.

The sneaky part? Your phone likely will not show obvious symptoms. No slowdown, no strange apps appearing, no frozen screen. By the time most people notice something is wrong, attackers have already done their damage.

Warning Signs to Watch For

Three signs may indicate FluBot infection. First, an app labeled "Voicemail" with a blue tape icon inside a yellow envelope might appear on your home screen—this is not a real voicemail app. Second, friends or family may contact you asking about texts or calls you did not send. Third, your mobile carrier might warn that your device is sending an unusual volume of messages.

What to Do If Infected

If you suspect FluBot has compromised your device, do not delay. According to security guidance, a factory reset is currently the only reliable way to remove it. No antivirus or security application has demonstrated the ability to fully detect and eliminate FluBot.

Before resetting, back up photos and contacts if possible—but be aware that malware could potentially travel with your backups. After the reset, restore only essential data and change passwords from a separate, trusted device.

Prevention remains your best defense. Never tap links in unexpected SMS messages, even when they appear to come from friends or known services. If a delivery notification arrives, go directly to the carrier or retailer website instead of clicking the link. Keep your device set to block app installations from unknown sources.

Why This Matters for Android Users

Android dominates the smartphone market at roughly 70 percent of global usage. For cybercriminals, that is a massive pool of potential victims. Even a small success rate yields huge rewards.

This is not a theoretical threat. Official figures show the scale: thousands of devices compromised in the UK alone, with tens of thousands of malicious texts dispatched every hour at peak activity. Australian authorities fielded over 16,000 reports within months.

The combination of urgent messaging, trusted brand impersonation, and silent operation makes FluBot particularly effective. Most victims never realize their device is compromised until financial losses occur or contacts report receiving strange messages.

Key takeaways

• FluBot spreads via SMS messages disguised as delivery alerts, voicemails, or software updates
• Only Android devices can be infected, since the malware requires installation from outside the official app store
• The malware steals credentials, intercepts bank SMS codes, and sends copies to your entire contact list
• Factory reset is the only proven removal method; no security app can fully eliminate it
• Prevention means never downloading apps from SMS links and verifying unexpected notifications directly with carriers