An active fraud campaign targeting users in Italy combines voice phishing, a real-time phishing control panel, and an Android remote access trojan. The operation begins with a phone call from someone impersonating N26 support and ends with the attacker controlling financial applications on the victim’s phone.
The malicious application is presented as a device certification component. Behind that pretext is a multistage Android dropper whose embedded payload belongs to the Copybara family.
This is not simply a credential-harvesting website. It is a human-operated workflow designed to move the attacker from social engineering to on-device fraud.
https://i0.wp.com/www.d3lab.net/wp-content/uploads/2026/07/dropper-installer-screen-1.png?fit=860%2C1350&ssl=11350860Andrea Draghettihttps://www.d3lab.net/wp-content/uploads/2019/04/D3Lab_Logo_Enfold-300x102.pngAndrea Draghetti2026-07-29 10:28:522026-07-29 10:37:23Inside an N26 Impersonation Campaign: From Vishing and Fake Control 1.0 to the Copybara Android RAT
During routine monitoring performed through D3Lab’s Brand Monitor service, our team detected a newly registered domain impersonating a well-known Italian banking brand. The domain was designed to look like a promotional landing page and promised users a financial reward for downloading a mobile application. At first glance, this looked like a classic brand abuse case. A closer analysis revealed something more serious: the landing page was part of a malware delivery chain distributing a malicious Android APK.
The affected brand, as well as its customers, should be considered victims of this campaign. The fraudulent infrastructure abuses the bank’s identity to gain trust, while the malicious application targets users who are convinced to install software outside official app stores. This is not a legitimate promotion, not a banking initiative, and not an official application distribution channel.
In June 2026, we analysed a malware campaign distributed through Italian-language phishing emails. The message pretended to deliver an invoice and used the subject Fattura #2818999851.
The victim was shown what looked like a PDF document. The downloaded file was instead an obfuscated Windows JavaScript file named Fattura-2819889242.pfd.js. The unusual pfd.js ending was likely intended to look similar to .pdf at a quick glance.
The most interesting part of this infection was not the initial JavaScript. The malware installed a malicious Google Chrome extension and paired it with a Native Messaging Host. This combination allowed code running inside Chrome to request PowerShell commands on the Windows system.
An extension normally cannot start local programs. Native Messaging changed that security boundary.
https://i0.wp.com/www.d3lab.net/wp-content/uploads/2026/06/Native-Messaging-Backdoor.png?fit=1672%2C941&ssl=19411672Andrea Draghettihttps://www.d3lab.net/wp-content/uploads/2019/04/D3Lab_Logo_Enfold-300x102.pngAndrea Draghetti2026-06-22 15:42:182026-06-22 15:44:16Breaking Out of Chrome’s Sandbox: A Native Messaging Backdoor Observed in Italy
Since February 2026, we have been tracking an invoice-themed malware campaign targeting Italian users and organizations. The messages are written in Italian and abuse a familiar business pretext: a short invoice notification that asks the recipient to open an attached HTML document. The lure is minimal, credible enough for a busy inbox, and designed to move the victim from email to browser to script execution.
One of the analyzed emails used the subject Nostra fattura nr. 91B. The body asked the recipient to review the attached document to view invoice details. The attachment was named Fattura_00121.html.
In January 2026, we analyzed NFCShare, an Android banking trojan distributed as a malicious APK through a phishing flow impersonating Deutsche Bank. The malware presented a fake card-verification interface, asked the victim to place a payment card near the phone, collected the card PIN, and exfiltrated NFC-derived payment-card data to a WebSocket endpoint.
Since 14 May 2026, we have observed a newer wave of NFCShare APKs impersonating Italian and European banking brands. The campaign we investigated started from an ad hoc phishing website, areaclienti-intesa.com, which mimicked the look and feel of Intesa Sanpaolo. After the victim entered home-banking credentials, the phishing flow prompted the user to update the banking application. At that point, the website visually directed the victim to a shortened URL, such as https://tinyurl[.]com/Intesa-Carte, which then redirected toward APKs hosted in the GitHub repository antoniocastaldo1998/app-scuola.
The newer samples are still NFCShare. The core NFC and exfiltration logic remains largely unchanged. The relevant evolution is operational and anti-analysis oriented: more frequent APK rebuilds, brand rotation, a new C2 endpoint, a 10-DEX layout, and malformed ZIP paths designed to break naive APK extractors.
https://i0.wp.com/www.d3lab.net/wp-content/uploads/2026/06/NFCShare_Cover.png?fit=1536%2C1024&ssl=110241536Andrea Draghettihttps://www.d3lab.net/wp-content/uploads/2019/04/D3Lab_Logo_Enfold-300x102.pngAndrea Draghetti2026-06-08 14:10:392026-06-08 14:10:41NFCShare evolves: from a banking phishing APK to a GitHub-hosted Android NFC fraud campaign
The D3Lab team analyzed an Android application distributed through a Deutsche Bank phishing campaign. Victims are prompted to enter their phone number, then instructed to “update” their banking app by downloading a malicious APK named deutsche.apk. The APK presents itself as “Support Nexi” and guides the user through a fake “card verification” flow: bring the card near the phone, keep it close while “authenticating,” and enter the card PIN. Under the hood, the app reads NFC card data (ISO‑DEP) and exfiltrates it to a remote WebSocket endpoint.
Based on consistent internal artifacts (package naming, classes, messages, and UI flow), we assign this new cluster the family name NFCShare.
Distribution: Deutsche Bank phishing flow
The infection chain starts with a bank‑themed phishing site mimicking Italian Deutsche Bank. The victim is asked for a mobile number and then told to update the bank app. The “update” is delivered as an APK (deutsche.apk). After installation, the app claims to be “Support Nexi” and drives the user through a fake security verification designed to harvest NFC card data and the card PIN.
During a recent investigation, we obtained access to a multi-package archive containing the complete development toolkit behind the Android malware known as BTMOB RAT. The archive includes the Android payload source code, its dropper, a builder environment, the operator panel for Windows, the command-and-control backend, and all the software dependencies required to deploy the full platform.
Every component is stored inside password-protected ZIP files. While ZIP file headers remain readable without a password, allowing us to inspect the file tree, their binary contents cannot be extracted. We intentionally chose not to acquire or circumvent the passwords, avoiding any action that may financially support or operationally benefit a criminal actor.
https://i0.wp.com/www.d3lab.net/wp-content/uploads/2025/12/BTMob_Inside.png?fit=800%2C800&ssl=1800800Andrea Draghettihttps://www.d3lab.net/wp-content/uploads/2019/04/D3Lab_Logo_Enfold-300x102.pngAndrea Draghetti2025-12-11 15:18:102025-12-11 16:05:26Inside BTMOB: An Analytical Breakdown of a Leaked Android RAT Ecosystem
During D3Lab’s continuous monitoring of newly registered domains through our Brand Monitor service, we identified a domain crafted to impersonate the Google Play Store.
The site advertises a supposed application called “GPT Trade”, presented as an AI-powered trading assistant and visually styled to resemble official ChatGPT / OpenAI branding. Unsuspecting users are encouraged to download an APK directly from the page: https://playgoogle-gpttrade[.]com/GPT%20Trade.apk
Our investigation revealed that GPT Trade is not a legitimate application, but a sophisticated Android dropper engineered to generate, prepare, and install multiple secondary malware payloads, including:
BTMob – a powerful spyware family
UASecurity Miner – a persistence-oriented component tied to a suspicious Android packing service
The overall structure of the attack shows a modern, modular approach where threat actors rely on packer-as-a-service platforms, Telegram bots, and impersonation techniques to distribute malware effectively.
https://i0.wp.com/www.d3lab.net/wp-content/uploads/2025/11/Screenshot-2025-11-14-alle-15.54.01-1.png?fit=1448%2C1099&ssl=110991448Andrea Draghettihttps://www.d3lab.net/wp-content/uploads/2019/04/D3Lab_Logo_Enfold-300x102.pngAndrea Draghetti2025-11-15 01:06:152025-11-15 01:10:42GPT Trade: Fake Google Play Store drops BTMob Spyware and UASecurity Miner on Android Devices
Recentemente una banca italiana è stata oggetto di una sofisticata campagna di phishing che ha portato alla diffusione del malware EagleSpy sui dispositivi Android. Questa minaccia ha lo scopo di rubare informazioni sensibili degli utenti attraverso una falsa richiesta di aggiornamento dell’app ufficiale della banca.
Modalità di Diffusione La campagna di phishing invia e-mail e messaggi apparentemente provenienti dalla banca, invitando gli utenti a fornire il loro nominativo, e-mail, codice utente e PIN. Una volta ottenute queste informazioni, la vittima viene indirizzata a scaricare un aggiornamento dell’app bancaria che, in realtà, installa il malware.
Android Malware EagleSpy è un Remote Access Trojan (RAT) progettato per ottenere accesso remoto non autorizzato ai dispositivi infetti, con funzionalità che includono la registrazione delle credenziali, la manipolazione dello schermo, il furto di PIN e codici di autenticazione a due fattori (2FA).
Il Threat Intelligence Team di D3Lab nelle quotidiane attività di analisi e contrasto alle frodi online ha rilevato la diffusione di un malware Android attraverso il servizio di allarme pubblico IT-Alert.
IT-alert è un nuovo sistema di allarme pubblico per l’informazione diretta alla popolazione, che dirama ai telefoni cellulari presenti in una determinata area geografica messaggi utili in caso di gravi emergenze o catastrofi imminenti o in corso.
Potremmo richiedere che i cookie siano attivi sul tuo dispositivo. Utilizziamo i cookie per farci sapere quando visitate i nostri siti web, come interagite con noi, per arricchire la vostra esperienza utente e per personalizzare il vostro rapporto con il nostro sito web.
Clicca sulle diverse rubriche delle categorie per saperne di più. Puoi anche modificare alcune delle tue preferenze. Tieni presente che il blocco di alcuni tipi di cookie potrebbe influire sulla tua esperienza sui nostri siti Web e sui servizi che siamo in grado di offrire.
Cookie essenziali del sito Web
Questi cookie sono strettamente necessari per fornirvi i servizi disponibili attraverso il nostro sito web e per utilizzare alcune delle sue caratteristiche.
Poiché questi cookie sono strettamente necessari per fornire il sito web, rifiutarli avrà un impatto come il nostro sito funziona. È sempre possibile bloccare o eliminare i cookie cambiando le impostazioni del browser e bloccando forzatamente tutti i cookie di questo sito. Ma questo ti chiederà sempre di accettare/rifiutare i cookie quando rivisiti il nostro sito.
Rispettiamo pienamente se si desidera rifiutare i cookie, ma per evitare di chiedervi gentilmente più e più volte di permettere di memorizzare i cookie per questo. L’utente è libero di rinunciare in qualsiasi momento o optare per altri cookie per ottenere un’esperienza migliore. Se rifiuti i cookie, rimuoveremo tutti i cookie impostati nel nostro dominio.
Vi forniamo un elenco dei cookie memorizzati sul vostro computer nel nostro dominio in modo che possiate controllare cosa abbiamo memorizzato. Per motivi di sicurezza non siamo in grado di mostrare o modificare i cookie di altri domini. Puoi controllarli nelle impostazioni di sicurezza del tuo browser.
Altri servizi esterni
Utilizziamo anche diversi servizi esterni come Google Webfonts, Google Maps e fornitori esterni di video. Poiché questi fornitori possono raccogliere dati personali come il tuo indirizzo IP, ti permettiamo di bloccarli qui. Si prega di notare che questo potrebbe ridurre notevolmente la funzionalità e l’aspetto del nostro sito. Le modifiche avranno effetto una volta ricaricata la pagina.
