ACCC released updated warning over ‘Flubot’ text message scam
The ACCC has put out another alert as thousands of Aussies continue to report an influx of scam texts flooding their inboxes.
The ACCC has put out another alert for mobile phone users, warning Aussies the annoying text messages telling them they’ve been tagged in videos online are continuing to come in thick and fast.
The ‘Flubot’ scam first arrived in Australia in August 2021, characterised by a text from an Australian phone number that enticed users to click on a link that would then infect their device with malware.
Bitdefender Labs wrote that “while investigating Flubot, researchers also discovered a Teabot variant being installed on devices without a malicious SMS being sent”. They linked the scam to a “Code Reader – Scanner App” that’s been “distributing 17 different Teabot variants for a little over a month”.
The development is concerning given the proliferation of Flubot scams since they first emerged. In the first eight weeks, 13,000 Australians made a formal complaint to the Scamwatch division of the Australian Competition and Consumer Commission (ACCC).
In a Tuesday release, Scamwatch reported there are a large number of different types of Flubot text messages and scammers are “updating them all the time”.
In some cases, if someone’s phone is infected with malware, their number is then used to send out more of the dodgy texts, much like a regular virus. The multiplying sources of text messages makes it extremely hard for experts to pinpoint the originator.
“Installing the software is likely to give scammers access to your passwords and accounts. They may be able to use this information to steal your money or personal information,” the statement read.
“It will also ask other infected Australian phones to send Flubot messages to the numbers it steals from your phone, continuing and expanding the scam. So, if you called the person that sent you the message, it would be another victim of the scam whose device was infected.
“We note that Apple devices cannot be infected with Flubot but will likely be infected with other malware if you click on these links.”
If you click the link and accidentally download malware, the application may be able to:
- Read your text messages
- Send text messages from your phone
- Make phone calls from your number
- Access your contacts
US-based ThreatPost website, which covers trends in the cybersecurity landscape, revealed scammers have been discovered using a new tactic based around QR codes.
ThreatPost wrote that researchers from Bitdefender Labs had “intercepted more than 100,000 malicious SMS messages trying to distribute Flubot malware since the beginning of December” and that “the team also discovered a QR code-reader app that’s been downloaded more than 100,000 times” to deliver malicious software onto users’ phones.
Cybersecurity expert and CEO of Prevailion Karim Hijazi, who specialises in cybersecurity breaches, outlined just how easy it was for regular people to get duped by a dodgy QR code.
“The QR code will send the user of the device to a website that then asks for information like payment information or personal information that they then harvest and use for ill gains or nefarious purposes,” Mr Hijazi told Fox News.
The most recent statistics say that as of early October last year, there have been 15,563 complaints about Flubot alone to date.
Only 13 people have reported losing money, to the tune of $10,542, after the malware compromised their bank accounts. There have been 20 reports of the photo album text scam, which was first reported on October 1.
“It’s very concerning to see these scams evolving and becoming more sophisticated to steal even more money from unsuspecting people,” ACCC Deputy Chair Delia Rickard said in a statement.
