Fortinet has provided updated information regarding Fluhorse, a malware that first emerged in May 2023 designed to steal two-factor authentication codes along with a multitude of other information types. Fluhorse, which was first identified last month by Check Point, is used to steal credentials, credit card information, and two-factor authentication codes received through SMS. This is accomplished by imitating Android applications from ETC and VPBank Neo, popular toll apps in east Asia, or through large scale phishing campaigns over email. What makes this malware unique is the fact that it uses Flutter, an open-source software development kit (SDK) that helps build applications compatible with Android, iOS, Linux, and Windows. The malicious code is directly integrated with the Flutter SDK, with the latest version of Fluhorse now incorporating packing and obfuscation techniques to further hide its intent. This is an upgrade over previous versions of the malware, showing that this is an evolving threat with increasing sophistication. Once installed, Fluhorse uses the Dart Telephony package, open-source code that enables the malware to listen to incoming SMS messages. The malware then posts the incoming SMS to a remote website in order to harvest two-factor authentication codes coming in. Ankura will continue to monitor the evolution of Fluhorse and the indicators of compromise associated with it.