FluBot: The Parcel-Delivery Text That Spreads Itself

A managed Android handset at Larkfield Mutual is infected by FluBot after the employee taps a smishing SMS impersonating a DHL parcel-delivery notice. The fake tracking page serves a parcel-themed APK, and once Accessibility and SMS permissions are granted, the trojan steals the contact list, blasts the same lure to every contact, intercepts bank 2FA codes, and tunnels its command-and-control over DNS-over-HTTPS. Walk the mobile telemetry and firewall logs step by step to trace the lure, the sideload, the contact theft, the SMS worm, and the hidden C2.