Copybara

Victims receive a SMS from their bank with a link, followed by a call by the operator to guide them through the process.

The campaign reportedly starts with repeated calls from an automated message or a person claiming to represent N26 support. The caller creates urgency around account security, then moves the target away from trusted banking channels and toward attacker-controlled contact details.

This feature is the key to perform On-Device Fraud (ODF) once PIIs are exfiltrated, and is implmented in both cases using libraries publicly available on the B4A forum.

The campaign discovered by our analysts is targeting multiple Italian banks and their customers. It involves multiple phishing sites impersonating several Italian financial services and anti-fraud offices.

Copybara is distributed via SMiShing . Victims receive a SMS from their bank with a link, followed by a call by the operator to guide them through the process.

Copybara is distributed via SMiShing. Victims receive a SMS from their bank with a link, followed by a call by the operator to guide them through the process.

Copybara, by virtue of being privately run, is able to heavily rely on TOAD (Telephone-oriented attack delivery) , which involves operators calling the victim to convince them to install and grant all the necessary permissions to function.

The caller, who purports to be a support agent for the bank, instructs the individual on the other end of the call to install a security app and grant it extensive permissions, when, in reality, it's malicious software intended to gain remote access or conduct financial fraud.

After the victim enters credentials on an N26-themed site, the attackers offer an Android package presented as a certification component.

This feature is the key to perform On-Device Fraud (ODF) once PIIs are exfiltrated, and is implmented in both cases using libraries publicly available on the B4A forum.

This malware family was also capable of keylogging data from victim’s devices thanks to Accessibility Service abuse, like most modern malware families are able to do nowadays.

Copybara abuses Android Accessibility, a legitimate feature intended to help users interact with their devices. Once enabled, it can perform taps, swipes, text entry, global actions, and capture information visible in active app windows.

This feature is the key to perform On-Device Fraud (ODF) once PIIs are exfiltrated, and is implmented in both cases using libraries publicly available on the B4A forum.

This malware family was also capable of keylogging data from victim’s devices thanks to Accessibility Service abuse, like most modern malware families are able to do nowadays.

Copybara abuses Android Accessibility, a legitimate feature intended to help users interact with their devices. Once enabled, it can perform taps, swipes, text entry, global actions, and capture information visible in active app windows.

The first campaign was quite limited in size, and was followed a few months after, between the end of 2021 and the beginning of 2022, by more refined campaigns, still targeting Italy, posing as an array of security related applications.

Copybara's RAT capabilities are powered by abusing the operating system's accessibility services API to gather sensitive information and even uninstall the downloader app to reduce its forensic footprint.

This feature is the key to perform On-Device Fraud (ODF) once PIIs are exfiltrated, and is implmented in both cases using libraries publicly available on the B4A forum.

The white N26-branded screen reported by a victim is especially concerning because it can hide activity happening underneath. Rather than breaking biometric protections, attackers may rely on victims to approve a real prompt without seeing what is actually being authorized.

Another quite unique feature recently introduced by authors is the ability to dynamically build fake input forms and show it to victims. Actors are able to specify arbitrary input fields, text labels, check boxes and collect even more data from victims. | While the TA is connected to infected device, Copybara shows a fake overlay that is semi-transparent to cover the actions of the cyber criminals. | All phishing sites seen in the campaign request similar set of personal data: account number, PIN code, telephone number. Our team noticed that, in some cases, cybercriminals request victims to choose secret questions and answers that were set during the registration process with the bank as second factor of authentication.

The main Copybara application is able to download an external module, capable of perfoming Accessibility event logging, a feature that is extremely important when implementing On-Device Fraud, as it allows criminal to have a full visibility and actionability on all the UI elements on the victim’s devices, as well as allowing to implement a very inclusive keylogging mechanism.

Whenever the overlay is triggered, the bot automatically opens a WebView with the corresponding phishing overlay to steal the wanted PII.

These apps are used to retrieve possible 2FA tokens from banks, as well as monitoring even further the device.

Another quite unique feature recently introduced by authors is the ability to dynamically build fake input forms and show it to victims. Actors are able to specify arbitrary input fields, text labels, check boxes and collect even more data from victims. | While the TA is connected to infected device, Copybara shows a fake overlay that is semi-transparent to cover the actions of the cyber criminals. | All phishing sites seen in the campaign request similar set of personal data: account number, PIN code, telephone number. Our team noticed that, in some cases, cybercriminals request victims to choose secret questions and answers that were set during the registration process with the bank as second factor of authentication.

The main Copybara application is able to download an external module, capable of perfoming Accessibility event logging, a feature that is extremely important when implementing On-Device Fraud, as it allows criminal to have a full visibility and actionability on all the UI elements on the victim’s devices, as well as allowing to implement a very inclusive keylogging mechanism.

Whenever the overlay is triggered, the bot automatically opens a WebView with the corresponding phishing overlay to steal the wanted PII.

SendMsg_sendmesc Send screenshot to the C2

Its available functions include keylogging, screen streaming, screen capture, microphone recording, camera access, file downloads, additional APK installation, notification suppression, and attempts to interfere with removal.

Its available functions include keylogging, screen streaming, screen capture, microphone recording, camera access, file downloads, additional APK installation, notification suppression, and attempts to interfere with removal.

Attackers communicate with infected phones through MQTT services hosted on a hard-coded server. The campaign uses one channel for commands and another for higher-volume activities such as camera access and screen capture, giving operators a direct route to manipulate the device remotely.

the C2 server sends a specific command/action to perform and Copybara handles it with the help of its Accessibility engine.

both generate a series of screenshots every few milliseconds, which then send to the C2 to mimic a real-time video stream. In this way, operators on the other side can interact with the device remotely, allowing criminals to perform actions directly on the infected device.

Both families also sport a relatively unique feauture, which allows to remotely initiate a factory reset on the device, potentially to disrupt investigations or clean the device from possible traces of infection.

“Modern banking malware focuses on initiating fraudulent transactions directly from a user’s device” and “76% provide transaction takeover capabilities.”