The "Flubot" scam began circulating in early August, targeting mobile phones with an often misspelt SMS message about a missed call and a malicious link that, when clicked, could harvest your contact list to spread further.

The scam however is mutating, with the Australian Competition and Consumer Commission (ACCC) warning the con is changing appearances.

READ ALSO:

Less than three weeks after this scam was first reported, Scamwatch had received over 5500 reports of these scams.

In August this year, vaccinated residents were being urged to look out for messages claiming to contain a link to a COVID-19 vaccine passport, and now the latest is targeting urgent parcel deliveries.

Scamwatch, and NSW Police issued the warning about the messages, which are disguised from reputable postal carriers, to take some form of action in relation to a delivery.

Included in the text is a link that, when clicked, enables scammers to download a malware app onto the phone.

An example of the kind of scam message will read "your DHL order will arrive soon. Track progress here", alongside a web link.

Receivers are urged not to click on the link and delete the message.

Orana Mid-Western Police District commander, Superintendent Danny Sullivan said scammers often sought to leverage off what's popular in the moment.

"They're leveraging off vulnerability, so they anticipate many of us are doing online shopping, and they anticipate the eagerness people have to get their goods, and as a consequence they exploit that by sending you a text," Supt Sullivan said.

He said scammers particularly benefited from creating a sense of urgency.

"When you feel that sense of urgency you're less likely or inclined to make good decisions," Supt Sullivan said.

The district commander however said the best solution is to always hesitate before you click.

"What we've found across the board and some of the tell tale signs is the spelling's pretty bad, very weird numbers," he said.

"I've had calls from all over the world telling me my packages are late.

"Always hesitate before you click."

The best advice for people have clicked on a link is to take action immediately, and not to enter any passwords or sign into any accounts until actions are taken to clean the device.

This can be done by seeking the assistance of an IT professional.

Our journalists work hard to provide local, up-to-date news to the community. This is how you can continue to access our trusted content: