FluHorse Malware Targets Android Devices, Steals Sensitive Data and Passwords

Check Point Research, a cybersecurity firm, has recently identified a new Android malware strain named “FluHorse,” which is designed to target users in Eastern Asia through the use of malicious apps that mimic legitimate versions.

The “FluHorse” Android malware has been actively targeting various industries in Eastern Asia since May 2022, and it is distributed via email with the aim of stealing sensitive data like banking information, passwords, and 2FA codes. The attack starts with an email sent to high-profile targets, urging them to address a payment-related issue, and leads the victim to a phishing site via a link. Upon downloading the fake app APK, the app can steal sensitive data.

Among the phony apps are ETC, a toll-collection app in Taiwan, and VPBank Neo, a Vietnamese banking app, both of which have more than 1 million downloads from Google Play Store. Additionally, Check Point Research found that the malware campaign also uses a fake transport app with 1,00,000 installs, although it was not named.

The malware campaign uses fake apps that mimic the GUI of legitimate apps but have limited functionality, with only a few windows to capture the victim’s information. Once the malware captures the victim’s data, the fake app displays a “system is busy” message for approximately 10 minutes to make the process appear more realistic while the operators behind the attack attempt to intercept 2FA codes and leverage the stolen data.

The malware was developed in Dart using the Flutter platform, making it challenging to reverse engineer and decompile, and the Flutter runtime for ARM uses its own stack pointer register, adding to the complexity of the analysis.

CheckPoint’s analysis of the malware campaign revealed that the use of a non-standard register for the Flutter runtime on ARM made it difficult to generate accurate pseudocode during the decompiling process.

Despite this challenge, the researchers were able to identify the functions responsible for stealing victims’ data and communicating with the command-and-control (C2) server. CheckPoint also warns that the campaign is ongoing and that new malicious apps and infrastructure are appearing regularly, posing an active threat to Android users.