A fake website of INPS, Italy’s social security institute, already includes instructions for installing an Android app outside official app stores, but the file it downloaded during the initial inspection could not infect a device: it contained just 40 bytes of text. CERT-AGID, the incident response team of the Agency for Digital Italy, warned that the site imitates the agency’s portal and that its link is being circulated via SMS.
The page offers a purported version of “INPS Mobile” and explains how to enable installation from unknown sources, if the phone requests it. CERT-AGID considers it plausible that the test file will be replaced with a malicious app. A later update to its analysis found a mechanism that allows whoever controls the website to choose which file to distribute via Telegram.
A download that looks real but installs nothing
CERT-AGID analyzed the site in collaboration with INPS. The domain had been registered just two days before it was detected and combines the Italian agency’s initials with the English word “Italy”. Punto Informatico and NewsUp.it identify Hosting Concepts B.V., a Dutch company based in Rotterdam, as the registrar, and note that the domain expires on November 9, 2027.
The website copies the name and part of the design of the INPS portal. A button to download the APK appears in the center; the instructions say that the file is called INPS_Mobile_v4.12.0.apk and should be opened from the downloads folder. The page also shows how to allow installation from unknown sources, a necessary step for installing apps outside the usual channels.
During CERT-AGID’s inspection, however, the download was simulated. The page’s code generated the file in the browser and displayed a progress bar whose speed and percentage were calculated at random. When it finished, the file with the APK extension contained only 40 bytes of text: it could not be installed on Android.
There are also visible signs that the website is unfinished. The content and instructions are in English, even though the page appears to target Italian users. “ENG” appears at the top next to an arrow suggesting a language selector, but the control does not work. Punto Informatico adds that none of the links on the homepage were operational.
Telegram makes it possible to change the download file
The assessment changed with the update CERT-AGID published at 21:30. In the hours after the initial review, probably following an update to the site, the team found a bot written in Python that lets the operator choose via Telegram which file visitors will receive. To publish it, they simply send the file to the bot and confirm the operation.
The system allows the operator to replace the APK without changing the link that had already been sent via SMS. Thus, the 40-byte file initially observed does not have to be the one offered later: whoever manages the site can change it via Telegram while keeping the address sent to potential victims.
The website also applies controls to visitors. It prioritizes connections coming from Italy and attempts to block automated visits and page- or directory-crawling tools when they use a default user agent. If it accepts a request, it tries to notify the operator via Telegram before starting the transfer.
That notification may include the requested file, the time, the IP address, an approximate location, and the visitor’s browser. CERT-AGID observed that both the code comments and the bot’s messages are written in Russian. It did not identify who is running the campaign and said that its origin remains unknown.
The SMS impersonates the agency; the goal is to install an app
The link arrives via SMS, a technique known as smishing. Punto Informatico and NewsUp.it describe messages that appear to come from INPS. The fake page tries to get recipients to download and install an app presented as the official Android app, even though the instructions lead to a manual installation.
CERT-AGID did not confirm that the 40-byte file observed in this campaign contains malware; in fact, it cannot be installed. Its concern is that the infrastructure is already prepared to serve a different file. The team links the case to previous campaigns that used the INPS name to distribute malicious APKs.
Punto Informatico explains that these campaigns typically seek to install fake apps that can act as infostealers, stealing data from the device, or as banking trojans capable of accessing bank accounts. This describes the type of threat associated with these campaigns, not an analysis of this site’s 40-byte file.
The SpyNote precedent is not the APK from this website
CERT-AGID previously documented a campaign targeting Android devices in Italy that disguised SpyNote malware as INPS Mobile. In that case, the phishing page had been reported by D3lab and offered a guide to downloading the fake app. The agency described an APK that, once installed, requested an update and permissions before displaying the legitimate INPS page.
That APK served as cover for installing another file hidden in the “assets” folder. CERT-AGID identified the malware as SpyNote and listed capabilities such as logging keystrokes, intercepting SMS messages, locating the device, stealing passwords and card data, capturing screenshots, and recording calls. It could also communicate with a command-and-control server and install additional payloads.
This precedent helps explain why the team is treating a page that still simulates the download with caution. But CERT-AGID did not identify SpyNote in the current file: the APK examined on this occasion was 40 bytes of text, and the possible malicious payload had not yet been distributed through it.
Takedown request and unknown origin
CERT-AGID has already shared indicators of compromise with the entities accredited in its IoC feed and requested that the domain be taken down. Punto Informatico and NewsUp.it reported that the website was still accessible when they published their articles on November 11, 2026.
To avoid installing a fake app, CERT-AGID recommends obtaining INPS Mobile through the agency’s official channels. The team also urges caution with received messages and advises users to pay attention to the domain name shown in the address bar.
The origin of those running the campaign remains unknown.
— CERT-AGID
The link distributed via SMS may continue to point to the same page even if the offered file changes: that is the function CERT-AGID attributes to the Telegram bot.
Sources: CERT-AGID, Punto Informatico, NewsUp.it, CERT-AGID
