All android phone users in the UK are being warned about a new scam that tries to steal their bank account details.
Those with android phones are being sent text messages containing links to tracking apps for delivery companies such as DHL, but the links are actually directing victims to a fraudulent app.
If someone using an Android phone clicks on the link, they will be taken to a page "explaining" how to install the parcel tracking app using something called an APK.
APK files are a way of installing Android apps outside of the secure Google Play store.
By default, such applications will be blocked for security reasons, but the scam page includes instructions on how to bypass any restrictions.
That can be confusing, as there are some niche genuine cases for installing those kind of apps - such as downloading the Fortnite video game, which was removed from the official app store amid a major legal row between its owner and Google.
Apple iPhone users are not affected as those phones cannot install Android APKs.
Flubot, as the app is known, can take over devices and spy on phones to gather sensitive data, including online banking details.
It also has the ability to trawl though contact lists, which allows the scam to widen its reach - reports Mirror Online.
Vodafone said millions of the text messages were already being sent, across all networks.
A spokesperson said: "We believe this current wave of Flubot malware SMS attacks will gain serious traction very quickly, and it's something that needs awareness to stop the spread."
The company said anyone who has installed the app should reset their device to factory settings.
Customers should "be especially vigilant with this particular piece of malware", he said, and be very careful about clicking on any links in a text message.
Other networks, including EE and Three, followed with warnings of their own.
Industry body Mobile UK said users who receive a suspicious message should forward it to 7726 to report it, a spokesman said - and then delete the message.
Action Fraud, the official anti-scams body, said suspicious text messages should be forwarded to 7726 where it can be investigated.
