New version of FluBot text scam tells phone owners their photos have been shared

Friday, 1 October 2021

An example of the fake security warning phone users have been tricked into visiting.

A fresh deluge of scam text messages are being sent to phone users, this time telling them that their photos have been uploaded and put online, the Department of Internal Affairs has warned.

2degrees, Vodafone and Spark warned on Wednesday that Android phone users were receiving large numbers of scam texts telling them they had a parcel that needed to be delivered.

The new texts suggest that people’s photos have been stolen and are being shared online, but are the same scam.

All the text messages contain a hyperlink to websites that will attempt to download a malware app called a FluBot to users’ phones.

* Victims of text scam deluge advised to wipe their phones and change passwords

An example of the scam text now being sent to mobile phones.

Internal Affairs said that the links on the new scam texts directed people to a fake security warning that said the person’s phone had been infected with a FluBot and tried to trick them into clicking on a button to install a “security update”.

If victims did that, the FluBot would be installed on their phone and would send out a further wave of scam messages to the contacts in their address book.

Internal Affairs digital messaging manager Joe Teo said more than 58,000 people had reported receiving one or other of the scam texts over the past 48 hours.

“If you receive a text from an unknown sender or a text with a suspicious hyperlink, do not click any links included in the message,” the department warned.

It encouraged anyone who had fallen victim to the scam to report it by forwarding the scam texts to 7726.

“We encourage everyone to talk to both young and vulnerable people to ensure they’re aware of this scam” Teo said.

Internal Affairs is continuing to advise anyone who has downloaded the FluBot to perform a factory reset on their phone which would mean they would lose any data – unless they could restore that from a back-up they had carried out before their phone was infected – and to change their online passwords.

Vodafone was on Thursday suggesting customers could instead attempt to delete the FluBot app without losing their data but, at the request of cyber-security agency Cert NZ, it is now advising customers to follow the same advice and perform a factory reset.