Inside an N26 Impersonation Campaign: From Vishing and Fake Control 1.0 to the Copybara Android RAT
From a fake N26 support call to the Copybara Android RAT: inside a human-operated phishing campaign designed for on-device financial fraud.
Pubblicati da Andrea Draghetti
Phishing Interactive Brokers in italiano: oltre 6.000 email tentano di rubare le credenziali
Il team antifrode di D3Lab ha rilevato il 17 luglio una campagna di phishing particolarmente massiva che sfrutta il nome e l’identità visiva di Interactive Brokers. Oltre 6.000 email, numerosi oggetti differenti e un’infrastruttura composta da più domini conducono le vittime verso una falsa procedura di verifica dell’account finalizzata al furto delle credenziali.
Fake Banking Rewards, Telegram Delivery and Albiriox: Anatomy of an Android Malware Campaign
A brand monitoring alert led D3Lab to uncover a fraudulent Android malware campaign abusing a major Italian banking brand. The campaign uses a fake reward landing page and a Telegram bot to convince victims to install a malicious APK. Technical analysis revealed a self-contained dropper delivering an embedded second-stage Android banking RAT identified as Albiriox, with Accessibility abuse, overlay capabilities, SMS interception, and custom TCP command-and-control infrastructure.
Nuova campagna di smishing sfrutta APCOA Flow per sottrarre dati delle carte di pagamento
Nel mese di giugno 2026 D3Lab ha rilevato almeno quattro campagne di smishing che sfruttano il brand APCOA Flow per simulare multe relative a parcheggi non pagati. L’obiettivo dei criminali è sottrarre i dati delle carte di pagamento delle vittime attraverso un sofisticato kit di phishing riconducibile alla famiglia Mouse System.
Breaking Out of Chrome’s Sandbox: A Native Messaging Backdoor Observed in Italy
A malicious Chrome extension observed in an Italian malspam campaign used Native Messaging to escape the browser sandbox, steal session data and execute remote PowerShell commands on Windows. This analysis explains the infection chain,
its command-and-control channel and the main detection opportunities.
Italian Invoice-Themed Phishing Campaign Delivers UpCrypter and NeptuneRAT
Italian invoice-themed phishing campaign targeting users since February 2026. The infection chain abuses HTML attachments, fake download pages, JavaScript, PowerShell, and UpCrypter to deploy a final NeptuneRAT/MasonRAT payload.
NFCShare evolves: from a banking phishing APK to a GitHub-hosted Android NFC fraud campaign
A new NFCShare Android malware campaign distributed through an Intesa Sanpaolo-themed phishing flow, short URLs, and GitHub-hosted APKs. The recent samples keep the same NFC card-theft logic but introduce stronger anti-analysis packaging, brand rotation, and frequent rebuilds.
B1ack’s Stash Releases 4.6 Million Payment Cards: Web Skimming Leak Analysis
B1ack’s Stash published a new free leak containing 4.6 million payment card records. Our analysis reviews the dataset structure, validation results, affected countries, payment networks,
Italy-specific findings, and the broader phishing and social engineering risks created by exposed personal data.
BreachForums Data Leaks: Technical Analysis and Timeline Attribution (2022–2026)
Technical analysis of BreachForums data leaks from 2022 to 2026, correlating publication dates with actual dataset timelines using the lastactive field to clarify attribution and infrastructure evolution.
Falsa email su ChatGPT: nuova campagna di phishing in Italia ruba dati delle carte e codici OTP
Prima campagna di phishing in lingua italiana che sfrutta il brand ChatGPT per sottrarre dati di carte e codici OTP. Analisi della minaccia e dei tentativi di frode osservati.