Zscaler Protections Against Flubot Banking Malware

This report describes the widespread Flubot Android banking malware campaign that uses SMS-based smishing to trick users into installing fake delivery or Chrome apps; once installed it harvests SMS and contacts, uses Accessibility Services to disable protections and display fake overlays to steal banking credentials and credit-card data, spreads via the victim's contacts, and uses DGA/RSA-protected C2 communications; the report also references vendor analysis and Zscaler detection coverage.