Ankura CTIX FLASH Update - June 30, 2023

Malware Activity

Fluhorse Android Malware Used to Steal 2FA Codes, Credentials, and Credit Card Information

Fortinet has provided updated information regarding Fluhorse, a malware that first emerged in May 2023 designed to steal two-factor authentication codes along with a multitude of other information types. Fluhorse, which was first identified last month by Check Point, is used to steal credentials, credit card information, and two-factor authentication codes received through SMS. This is accomplished by imitating Android applications from ETC and VPBank Neo, popular toll apps in East Asia, or through large-scale phishing campaigns over email. What makes this malware unique is the fact that it uses Flutter, an open-source software development kit (SDK) that helps build applications compatible with Android, iOS, Linux, and Windows. The malicious code is directly integrated with the Flutter SDK, with the latest version of Fluhorse now incorporating packing and