Advanced N26 Phishing Campaign Uses Vishing, Fake Control Panel, Copybara Android RAT

A fraud operation targeting bank customers in Italy is combining three distinct techniques rarely seen together so tightly: live voice phishing, a real-time phishing control panel, and a fully featured Android remote access trojan.

The campaign impersonates N26, the German digital bank, and walks victims through a fake “device certification” process that culminates in attackers silently operating banking apps on the victim’s phone.

The operation was first publicly flagged by researcher ShadowOpCode on X, who cited a detailed victim account posted on Reddit. What emerges from technical analysis is not a simple credential-phishing kit but a human-operated fraud workflow designed to move a victim step by step from a phone call to on-device financial theft.

Advanced N26 Phishing Campaign Uses Vishing

The scheme begins with automated calls warning that “additional account verification” is required. A supposed N26 representative then walks the victim through a device “certification” process, reinforcing legitimacy by referencing real messages already visible inside the victim’s banking app.

The victim is guided outside official bank channels to a fraudulent support email, which leads to an N26-themed login page on an attacker-controlled domain.

After the credentials are entered, the site pushes an Android APK and instructs the victim to grant Accessibility, location, and device control permissions. Once granted, an N26-branded loading screen covers the display while, underneath it, the attacker reportedly attempts transactions across multiple financial apps.

The phishing site runs on infrastructure identified with high confidence as Fake Control 1.0 (also known as AdminLTE-based kits), built on PHP, SQLite, and JavaScript with an administrative dashboard. AdminLTE itself is a legitimate open-source template; the malicious element is the workflow built around it.

The kit gives operators:

• Live victim session tracking, refreshed every few seconds
• Credential and one-time-code collection across multiple stages
• Remote commands including fake messages, token validation, transaction-cancellation lures, and APK delivery
• SQLite-based logging with backup databases and export tools

Portuguese-language identifiers in the code (senha, gerente, enviarComando) hint at the kit’s development origin but don’t confirm operator nationality.

e.g., “What makes this campaign notable isn’t the malware itself, but the orchestration layer. Fake Control 1.0 turns social engineering into a real-time, adaptive performance the operator sees exactly what the victim sees and reacts instantly. That human-in-the-loop element is what makes takedown and detection so difficult.”]

The outer app, disguised as N26 Pdf (package io.smart.evolve), presents itself as a component called “Certificato N26.” It uses a multistage loading chain:

1. Dropper extracts a hidden asset and decrypts it via RC4
2. Decrypted JAR reveals a loader DEX
3. Loader installs an embedded base.apk
4. That payload is the Copybara Android RAT

The dropper also spins up a local VPN targeting the Google Play Store package, discarding its traffic for 240 seconds, likely to disrupt Play Protect scanning during installation. Both dropper and payload use deliberate ZIP structure anomalies to break automated analysis tools, a known anti-detection technique.

The embedded APK, labeled “Certificato N26” (package com.upy2dl.ptroa5), is attributed with high confidence to the Copybara malware family, based on its B4X codebase and MQTT-based command infrastructure.

Copybara’s capabilities include:

• Full Accessibility-service-driven remote control (clicks, swipes, text entry)
• Screen streaming, MediaProjection capture, camera and microphone access
• SMS interception, contact and call log theft
• Silent app installation, icon hiding, and uninstall resistance

Command traffic flows over MQTT to a hardcoded C2 at 37[.]148[.]161[.]44, using ports 52997 and 52998. Interestingly, the payload contains a fully built decoy app called Battery Cleaner Pro, complete with six localized HTML interfaces (English, Italian, German, Spanish, French, Portuguese) showing hard-coded fake battery and memory stats.

This isn’t bundled by accident; it’s the RAT’s default cover identity once the N26 theme has served its purpose, allowing the same Copybara build to be reused across different campaigns and brands.

The campaign separates its operations cleanly: Fake Control 1.0 manages the social-engineering and credential-harvesting phase, while Copybara takes over post-installation via its own MQTT channel.

Overlay templates are fetched dynamically from the C2 server rather than embedded in the app, so static analysis can’t reveal a complete list of targeted banks; however, N26, Poste, Intesa Sanpaolo, and Microsoft Authenticator have all been observed in victim reports.

Each stage of this campaign reinforces the next: the vishing call builds trust and urgency, Fake Control 1.0 gives the operator a live view of the phishing session, and Copybara delivers the on-device control needed to complete the fraud. The white “N26 loading screen” victims see isn’t a security process; it’s the curtain concealing the attack underneath.

About the Author

Harish Kumar

Author

Visit Website View All Posts