“TangleBot”, a new smishing malware, has recently been discovered targeting Android mobile devices in the United States and Canada with lures regarding COVID-19 regulations and vaccine information. Cloudmark, Proofpoint’s messaging security subsidiary, provided a thorough analysis of the emerging malware campaign in a report, which is linked below, and emphasized that TangleBot has “many layers of obfuscation and control over a myriad of entangled device functions, including contacts, SMS and phone capabilities, call logs, internet access, and camera and microphone”. Cloudmark researchers also explained that the malware has the capabilities to overlay screens and control device interaction with banking applications, and directly obtain victims’ sensitive information as well as exfiltrate victims’ account information from financial activities initiated on the mobile device. The campaign lures have been identified to be SMS messages containing notification/confirmation messages, such as “New regulations about COVID-19 in your region. Read here:” or “You have received the appoint for the 3rd dose. For more information visit:”, with malicious links that notifies the victim of their Adobe Flash Player being out-of-date once clicked. The TangleBot malware is then downloaded once the victim opts to “update” the software. TangleBot capabilities, which brands the malware as spyware, can be easily undetected by the victim and security researchers advise Android users to be wary of unexpected SMS messages as well as to visit the source of the messages directly as opposed to using links in SMS messages.