“FluBot”, an Android banking trojan noted for targeting various countries across Europe and Asia this past year, has been identified in new campaigns being disguised as Flash Player as well as observed having new features in its most recent releases. FluBot is primarily distributed via SMS phishing (smishing) as fraudulent security updates, voicemail memos, delivery notices, and Adobe Flash Players. The malware exfiltrates credentials via overlay login forms on banking applications, captures screenshots, and intercepts/sends SMS messages. MalwareHunterTeam stated that the new campaigns are distributed specifically through SMS messages that ask the “recipient if they intended to upload a video from their device” and when the attached link is clicked, a fraudulent Flash Player APK is offered that installs FluBot onto the device. Along with the new phishing prompt, FluBot operators added new features to the malware in the most recent releases (versions 5.0 to 5.2). One new feature involves an update in the malware’s domain generation algorithm (DGA), in which thirty (30) top-level domains are utilized as opposed to three (3) seen previously and a command was added that “enables attackers to change the [domain] remotely”. Additional features/commands were added in FluBot’s newest major update that can be viewed in technical detail in F5’s report (linked below) along with indicators of compromise (IOCs).