A new fraud campaign is targeting Android banking users through convincing phone calls that impersonate N26 support staff. The attack begins as voice phishing, but it can end with criminals remotely controlling banking apps on a victim’s phone.
Victims are told that their account needs urgent verification or a device certification update.
Attackers then guide them to a fake login page, collect credentials, and persuade them to install a malicious Android application outside the official app store.
Researchers at d3 Lab identified the malware as Copybara, an Android remote access trojan built to steal data and perform actions through abused accessibility permissions.
d3 Lab said in a report shared with Cyber Security News (CSN) that the campaign combines social engineering, a live phishing panel, and malware delivery into one coordinated operation.
The result is more dangerous than a typical fake banking page. Attackers can keep victims occupied with a false N26 loading screen while using the phone in the background, potentially accessing financial apps, reading messages, and attempting transactions.
Fake N26 Support Calls Deploy Copybara Android RAT
The campaign reportedly starts with repeated calls from an automated message or a person claiming to represent N26 support.
The caller creates urgency around account security, then moves the target away from trusted banking channels and toward attacker-controlled contact details. This mirrors broader voice phishing attack patterns that rely on trust instead of software exploits.
After the victim enters credentials on an N26-themed site, the attackers offer an Android package presented as a certification component.
The outer application calls itself “N26 Pdf” and uses the package name io.smart.evolve, while displaying an update screen for “Certificato N26.”
The app asks the victim to allow installations from unknown sources, then installs a hidden second-stage payload.
It also temporarily creates a local VPN rule affecting the Google Play Store, an action researchers believe may disrupt security checks while the malware installation is underway.
The embedded Copybara payload is disguised as “Certificato N26” and later presents a generic Battery Cleaner Pro interface. That screen is merely cover: its battery, memory, temperature, and cleaning information is hard-coded rather than generated by a real utility.
This use of a familiar-looking app follows the same strategy seen in fake banking app campaigns, where attackers depend on a victim installing an APK and approving invasive permissions.
Remote Access Behind the Screen
Copybara abuses Android Accessibility, a legitimate feature intended to help users interact with their devices. Once enabled, it can perform taps, swipes, text entry, global actions, and capture information visible in active app windows.
The malware can also collect SMS messages, contacts, call logs, installed-app lists, device identifiers, and other phone information.
Its available functions include keylogging, screen streaming, screen capture, microphone recording, camera access, file downloads, additional APK installation, notification suppression, and attempts to interfere with removal.
Attackers communicate with infected phones through MQTT services hosted on a hard-coded server.
The campaign uses one channel for commands and another for higher-volume activities such as camera access and screen capture, giving operators a direct route to manipulate the device remotely.
The white N26-branded screen reported by a victim is especially concerning because it can hide activity happening underneath. Rather than breaking biometric protections, attackers may rely on victims to approve a real prompt without seeing what is actually being authorized.
Users should treat unsolicited banking support calls as suspicious, end the call, and contact their bank only through its official application or published number.
They should never install an APK sent by a caller, text message, or email, and should be wary of unexpected accessibility requests, as explained in coverage of accessibility permission abuse risks.
Indicators of compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| SHA-256 | 464fee5a6d85370e8764f0e682ef01cf2d9cef3efb7e4bbdf0146a94cc83ff4a | Malicious outer dropper |
| SHA-256 | 0475a46c70d8671322d39392c55d404b6d8f4de34090f0373244cef52ae55708 | Decrypted JAR loader |
| SHA-256 | b88668403a6dabe4867573fc23c11ce937291f6aab7e65e8261b4c967ab2e68c | Loader DEX |
| SHA-256 | 7cf365d61e59d5c3dd50295b1d5a0c360da9eba1b4dc00cdc0f1ceee4a5cc412 | Copybara embedded payload APK |
| MD5 | e792fedfd11d56a9ad68e6d407b9a09e | Copybara embedded payload APK |
| Package | io.smart.evolve | N26 Pdf dropper package |
| Package | com.upy2dl.ptroa5 | Copybara payload package |
| Domain | n26portale[.]com | Phishing and Fake Control infrastructure |
| Domain | n26[.]com[.]de | Fraudulent support email infrastructure |
assistenza@n26[.]com[.]de | Campaign contact address | |
| IPv4 | 37[.]148[.]161[.]44 | Copybara command-and-control and content host |
| Port | 52997/TCP | Primary MQTT command channel |
| Port | 52998/TCP | Camera and MediaProjection MQTT channel |
| MQTT Topic | commandsFromPC | Copybara command channel |
| Filename | WJcugJ.jar | Encrypted loader marker |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
