D3Lab uncovered an Italian-language phishing campaign that went beyond credential theft. While victims interacted with a fraudulent page, an iframe loaded a multi-stage WebKit exploit chain targeting outdated iOS devices and connected
them to dedicated command-and-control infrastructure.
From a fake N26 support call to the Copybara Android RAT: inside a human-operated phishing campaign designed for on-device financial fraud.
Il team antifrode di D3Lab ha rilevato il 17 luglio una campagna di phishing particolarmente massiva che sfrutta il nome e l’identità visiva di Interactive Brokers. Oltre 6.000 email, numerosi oggetti differenti e un’infrastruttura composta da più domini conducono le vittime verso una falsa procedura di verifica dell’account finalizzata al furto delle credenziali.
A brand monitoring alert led D3Lab to uncover a fraudulent Android malware campaign abusing a major Italian banking brand. The campaign uses a fake reward landing page and a Telegram bot to convince victims to install a malicious APK. Technical analysis revealed a self-contained dropper delivering an embedded second-stage Android banking RAT identified as Albiriox, with Accessibility abuse, overlay capabilities, SMS interception, and custom TCP command-and-control infrastructure.
Nel mese di giugno 2026 D3Lab ha rilevato almeno quattro campagne di smishing che sfruttano il brand APCOA Flow per simulare multe relative a parcheggi non pagati. L’obiettivo dei criminali è sottrarre i dati delle carte di pagamento delle vittime attraverso un sofisticato kit di phishing riconducibile alla famiglia Mouse System.
A malicious Chrome extension observed in an Italian malspam campaign used Native Messaging to escape the browser sandbox, steal session data and execute remote PowerShell commands on Windows. This analysis explains the infection chain,
its command-and-control channel and the main detection opportunities.
Italian invoice-themed phishing campaign targeting users since February 2026. The infection chain abuses HTML attachments, fake download pages, JavaScript, PowerShell, and UpCrypter to deploy a final NeptuneRAT/MasonRAT payload.
A new NFCShare Android malware campaign distributed through an Intesa Sanpaolo-themed phishing flow, short URLs, and GitHub-hosted APKs. The recent samples keep the same NFC card-theft logic but introduce stronger anti-analysis packaging, brand rotation, and frequent rebuilds.
B1ack’s Stash published a new free leak containing 4.6 million payment card records. Our analysis reviews the dataset structure, validation results, affected countries, payment networks,
Italy-specific findings, and the broader phishing and social engineering risks created by exposed personal data.
Technical analysis of BreachForums data leaks from 2022 to 2026, correlating publication dates with actual dataset timelines using the lastactive field to clarify attribution and infrastructure evolution.