Flubot on Android

This warning comes courtesy of the BBC website.

A text-message scam that infects Android phones is spreading across the UK, experts have warned.

Flubot Scam

The message - which pretends to be from a package delivery firm, prompts users to install a tracking app - but is actually a malicious piece of spyware.

Called Flubot, it can take over devices and spy on phones to gather sensitive data, including online banking details.

Network operator Vodafone said millions of the text messages were already being sent, across all networks.

"We believe this current wave of Flubot malware SMS attacks will gain serious traction very quickly, and it's something that needs awareness to stop the spread," a spokesman said.

Customers should "be especially vigilant with this particular piece of malware", he said, and be very careful about clicking on any links in a text message.

Other networks, including EE and Three, followed with warnings of their own.

The National Cyber Security Centre (NCSC) later issued guidance about the threat, including advice on what to do if you have already downloaded the attacker's application by mistake.

"If users have clicked a malicious link it's important not to panic - there are actionable steps they can take to protect their devices and their accounts," the NCSC said in a statement.

The malware also has the ability to send more text messages to an infected user's contacts, helping it spread.

"The seriousness of these malicious text messages is underlined by Vodafone making the decision to alert its customers," said Ben Wood, chief analyst at CCS Insight.

"This has the potential to become a denial-of-service attack on mobile networks, given the clear risk that a rogue application can be installed on users' smartphones and start spewing out endless text messages.

"The broader risk for users is a loss of highly sensitive personal data from their phones," he added.