An active fraud campaign targeting N26 users in Italy is combining voice phishing, a live phishing control panel, and the Copybara Android remote access trojan (RAT) to take over banking applications.
The operation begins with calls from attackers posing as N26 support staff. Victims are told that their account or device requires urgent verification.
The callers then guide targets through a fake “device certification” process, using legitimate messages already visible in the N26 app to make the story appear credible.
ShadowOpCode publicly highlighted the campaign on X, citing a detailed victim account posted on Reddit. In the reported case, the victim was moved away from official bank channels and instructed to contact a fraudulent support address.
The victim then received an N26-themed phishing page hosted on attacker infrastructure.
N26 Support Scam Deploys RAT
The phishing website appears to be linked to a web-based system tracked as Fake Control 1.0. The PHP, SQLite, and JavaScript-based platform uses an AdminLTE dashboard template to manage victim sessions in real time.
AdminLTE is legitimate software, but the surrounding workflow is designed for fraud.
The control panel stores victim records, collects credentials and one-time passcodes, refreshes operator dashboards every few seconds, and lets criminals change the content shown to an individual victim.
Available actions include sending messages, validating or rejecting authentication tokens, displaying transaction-cancellation lures, and triggering APK downloads.
This turns the phishing page into an interactive operator console rather than a static banking login clone.
The Android dropper uses the package name io.smart.evolve and calls itself “N26 Pdf.” It extracts and installs an embedded payload after requesting permission to install applications from unknown sources.
Researchers found that the dropper also creates a local VPN targeting the Google Play Store package, com.android.vending.
It routes and discards traffic for 240240240 seconds, potentially disrupting Play Store or Play Protect checks during installation.
Both the dropper and embedded payload include malformed ZIP structures, unusual Unicode paths, oversized fields, and file-directory collisions. These features can break standard analysis tools and complicate static inspection.
The final payload, identified with high confidence as Copybara, uses the package name com.upy2dl.ptroa5 and masquerades as “Certificato N26.”
It contains a B4A/B4X codebase and communicates with command-and-control infrastructure through MQTT.
Copybara subscribes to the commands_FromPC MQTT topic and receives remote instructions through TCP port 529975299752997.
Screen streaming, camera, and MediaProjection features use port 529985299852998. Its hardcoded command-and-control address is 37[.]148[.]161[.]44, d3lab said.
Indicators of Compromise
| Type | Indicator | Role |
|---|---|---|
| SHA-256 | 464fee5a6d85370e8764f0e682ef01cf2d9cef3efb7e4bbdf0146a94cc83ff4a | N26 Pdf malicious dropper |
| SHA-256 | 0475a46c70d8671322d39392c55d404b6d8f4de34090f0373244cef52ae55708 | Decrypted loader JAR |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
