New Copybara Malware Remotely Hijacks Your Android Device

Copybara is a persistent Android banking Trojan (active since 2021) that targets users—notably in Italy and Spain—by distributing fake apps and phishing pages that mimic banks and cryptocurrency exchanges. The November 2023 variant adopts MQTT for C2 communications and, once Accessibility Service is enabled, can keylog, record audio/video, intercept SMS, take screenshots, lock devices, steal credentials, download/install additional malicious apps, and exfiltrate data; the report includes phishing links, malicious APK names, and evidence of live C2-hosted phishing pages.