www.belgium.be Logo of the federal government
News

Since last week, mobile operators have been blocking more than 2 million text messages per day. The dangerous FluBot virus is on the rise again. This virus can take full control of mobile phones and send text messages on behalf of the victim to all contacts stored in the device's phone book as well as to other mobile phone numbers. Over 2,000 infected mobile phones have already been blocked by mobile operators in recent days due to abnormally high text message traffic.

"The suspicious text messages claim to come from a courier service. If you click on the link displayed in the text message, you will be asked to download an application. Don't do it. If you do, you will install a virus on your device that can access your personal data such as passwords, credit card information and your entire contact list," says Katrien Eggers, spokesperson for the Centre for Cyber Security Belgium (CCB).

The text messages are sent from the mobile phones that have been infected with the mobile malware FluBot (the name of the virus that spreads via text messages). It is difficult to determine the exact origin of the text messages, because once infected, the client's mobile phone starts sending it to other users. In other words, these text messages come from legitimate customers of telecom operators.

Urgent warning

Jack Hamande, BIPT Board Member: "When operators find that a customer has been infected, for example based on unusually high text messaging traffic, they will temporarily block this customer, explaining to them why they have been blocked and instructing them on how to remove the malware. It is then up to the customer to remove the mobile malware from their device. It is important for customers to do so. After all, the malware will also send international text messages, which can potentially result in high bills."

Operators will temporarily block the numbers of infected customers. The customer can still make calls and receive text messages, but they can no longer send them. After a certain period of time, or after the customer has indicated that they have removed the malware, they can send messages again. If new suspicious text messaging traffic is detected, the customer will be temporarily blocked again.

Since last week, mobile operators have been blocking more than 2 million text messages per day. Over 2,000 infected mobile phones have already been blocked by mobile operators in recent days due to abnormally high text message traffic.

This is why BIPT and CCB are launching an urgent appeal to mobile phone users:

1. Always be extra careful when receiving an unexpected message

2. Do not click on a link contained in a text message!

3. Never install applications via a link that was sent by text message

Only install applications from an official app store (Google Play, App Store). When you are installing an application and you receive a message preventing the installation or giving a security warning, do not continue.

Anyone who has installed Flubot on their mobile phone should immediately remove the virus. This can be done by one of two methods:

  • Method 1: Restoring the device to factory settings
  • Method 2: Rebooting the device in "safe mode" and then deleting the fake application

After removing the virus, change all the passwords of the accounts you have access to from your smartphone. As a text message may have been sent on behalf of the victim to all their contacts, they should also be notified as soon as possible.

Victims may not always notice straight away that a very large number of text messages have been sent. They may only realise when they see the large bill racked up by the text messages. In this case, the victim should contact their operator. The only way to stop the virus from misusing your number is to remove the application.

You can send screenshots of the fraudulent messages to [email protected]

More info https://safeonweb.be/en/news/beware-dangerous-flubot-virus-dont-click-suspicious-text-messages