Security researcher @masaomi346 posted on X on 11 November 2026 about Android malware impersonating FamilyMart (ファミリーマート), the Japanese convenience store chain, distributed from hxxps://hanwgsercassa.eu[.]cc/, tagged…
Source: x.com · published
Security researcher @masaomi346 posted on X on 11 November 2026 about Android malware impersonating FamilyMart (ファミリーマート), the Japanese convenience store chain, distributed from hxxps://hanwgsercassa.eu[.]cc/, tagged #Phishing and #malware. FamilyMart is impersonated and is not the operator. Install apps only from the official Google Play store and never from links in texts or emails.
Android malware is often spread as a link or QR code that claims to be an official store, coupon or membership app. Installing an APK from a site such as hanwgsercassa.eu.cc, instead of from the official app store, can give the operator access to messages, overlays or accessibility services used to steal logins and approve payments. FamilyMart was impersonated and is not involved.
Do not sideload an app because a message or flyer told you to. If you already installed something from that host, uninstall it, run a mobile security scan and review bank and wallet activity.
A familiar convenience-store logo on a download page is not a substitute for an official app store listing. If a flyer, text or QR code tells you to install a FamilyMart-branded app from a .eu.cc domain, treat it as hostile and report the link to the store and to your mobile operator if it arrived by SMS. Official FamilyMart apps are published in the official app stores, not as a sideloaded file from a newly reported host.
Public post on X, 11 November 2026: https://x.com/masaomi346/status/2120430576440373645
The indicators come from this source and have not been independently checked by scammers.com.
Security researcher @masaomi346 posted on X on 12 November 2026 about Android malware impersonating Rakuten (楽天), the Japanese e-commerce and financial services group, linking a VirusTotal analysis of the sample. The…
Poland's national computer emergency response team CERT Polska warned on X on 12 November 2026 about a new SMS campaign in which fraudsters pose as police units, including traffic departments and regional police headq…
CSIRT Italia warns of renewed smishing claiming PagoPA/SEND fines; links lead to send-au.eu.cc to steal logins and card data. PagoPA and SEND are impersonated.
Security researcher @KesaGataMe0 posted on X on 12 November 2026 a list of sites labeled as malware distribution impersonating SMBC / SMCC / Sumitomo Mitsui Card (三井住友カード), all at IP 8.216.50.3 (AS45102, Alibaba (US)…
The UK Financial Conduct Authority (FCA) published a warning on 12 November 2026 that wavelendinglimited.co.uk and wavelendingltd.com are a clone of a previously FCA-authorised firm. The FCA lists the telephone number…
The UK Financial Conduct Authority (FCA) published a warning on 12 November 2026 about a clone firm called 'Car Insur' using the websites veygo.info and veygoadmiral.info. The FCA says the firm is not authorised by it…