AgID has identified a fake INPS website, spreadNPS Mobile». The domain was registered only a few days ago and the page is still being set up. For now, the file on offer is just a 40-byte placeholder. It matters because sources recall that similar campaigns have already distributed real malicious apps, and this one looks ready to follow the same path
A few terms before we get into the facts. CERT-AgID is the Computer Emergency Response Team of the Italian Digital Agency, the body that monitors cyber threats. Smishing is phishing carried outideloading means installing an app outside the Google Play Store. Infostealer and banking trojan are malware that steal data from the device or access bank accounts
What did CERT-AgID discover?
According to Punto Informatico, CERT-AgID experts have identified a fake INPS site distributing an Android app. The link arrivesimitates the Institute’s logo, name and graphics
The page is only in English, the language selector is inactive and no link on the home page works. For HDblog the site still appears to be under construction
What does the site’s domain reveal?
The name combines the acronym «INPS» with the English word «Italy», a detail that can be misleading. Sources speak of a very recent registration, from two days to a handful of days, depending on the article.
Punto Informatico adds that the domain was registered with Hosting Concepts B.V., a Dutch company based in Rotterdam, and expires on 9 November 2027. CERT-AgID has requested the shutdown, but at the time of the news the site was still accessible.
Why is the APK file fake?
At the centre of the page is the «Download APK» button. Clicking it starts a download with a progress bar and transfer speed, but according to Smartworld both are generated randomly by the browser. The file is a 40-byte text file that cannot be installed on Android.
HDblog describes it as a placeholder waiting to be replaced with a malicious app. The page also explains how to enable installation from unknown sources, the key step of sideloading.
What could the real app do?
According to Punto Informatico, these apps usually contain an infostealer or a banking trojan. Smartworld indicates as the most likely hypothesis that the file will soon be replaced with an application capable of stealing data from the phone.
It is not certain, but the precedent exists. The method is the same as the email scams we described in phishing and email scams, how to recognise them in the company.
Limits to know
Sources do not say how many people received the SMS or who is behind the campaign. It is not known which malware will replace the fake file, and no articles. It remains to be seen whether the shutdown requested by CERT-AgID will happen and whether criminals will move the campaign to another domain
What changes for those who work with digital tools
If you run a business, warn your employees that no public body asks you to install appsnstallation from unknown sources turned off. If you develop apps, publish the official channel clearly, as we also explain when discussing iOS and Android app development, so users know where to find them. Always checking the domain in the address bar remains the simplest habit
Our take
The case is useful because it shows a scam caught early, before it became operational. The fake download with a random percentage, however, signals care for appearance, not for technique. The real weak point remains the user, pushed to enable unknown sources. Public bodies would need to communicate more, with a simple message repeated often. The sideloading instructions on the page should set off alarm bells for anyone.
Frequently asked questions
What should I do if I receive the SMS?
Do not click the link and do not download anything. Smartworld reminds that INPS does not distribute updates
Is the APK file dangerous right now?
No, it was not at the time of analysis. It was a 40-byte text file that cannot be installed on Android. Sources warn, however, that it could be replaced with a malicious app.
What is sideloading?
It is installing an app outside the Google Play Store. Smartworld describes it as the classic method for getting less experienced users to install unverified apps.
Who discovered the site?
CERT-AgID, the unit of the Italian Digital Agency that monitors cyber threats. It reported the technical data to the competent bodies and requested the domain be shut down.
Where can I download the real INPS app?
From the official INPS pages and from the app stores. Punto Informatico points to the Institute’s page for Android and iOS apps. Always check the domain before trusting it.
If the domain shuts down, the campaign moves elsewhere
The shutdown request may stop this site, but not the technique. It is worth watching how the campaign evolves.
- Check whether CERT-AgID publishes updates on the domain and the APK file.
- Keep an eye out for new SMS mentioning INPS with similar domains or in other languages.
- Make sure installation from unknown sources is disabled on home and work phones.
