Security researcher @masaomi346 posted on X on 12 November 2026 about Android malware impersonating Rakuten (楽天), the Japanese e-commerce and financial services group, linking a VirusTotal analysis of the sample. The…
Source: x.com · published
Security researcher @masaomi346 posted on X on 12 November 2026 about Android malware impersonating Rakuten (楽天), the Japanese e-commerce and financial services group, linking a VirusTotal analysis of the sample. The post lists these domains: acidw.com, acpdns.com, aelogo.com, ancreda.com, armoky.com, rebenz.com, rainsu.com and risooo.com. Rakuten is impersonated and is not the operator. Install apps only from Google Play or the official Rakuten website, and do not install APK files sent via links in SMS or email. Source: https://x.com/masaomi346/status/2120744451358564679
These pages copy a familiar login, payment or delivery form so that a typed password, one-time code, card number or other personal detail goes to the operator rather than to the real company. The address is often a look-alike domain, a newly registered shop, or a free host such as Weebly, Wix, Firebase, Vercel, Workers or Pages. Some kits cloak the real form from scanners and only show it in certain countries or to certain devices. The brand whose name or logo appears is being impersonated and is not involved, unless the report says the page was planted on a compromised official site, in which case only that path is the phishing lure. Open the official app or type the company's real address yourself. If you already entered a password or a card number, change the password on the official site, turn on a new two-factor method, and contact the company and your bank.
If a message, a page or a caller creates urgency about money, a login or a legal threat, pause and check the claim through a contact method you already trust. Keep screenshots, reference numbers and the exact addresses or phone numbers you were given, and tell your bank early if money has already left the account. Official brands and authorised firms named in a lure are not involved unless a primary source says otherwise.
Security researcher @masaomi346 posted on X on 11 November 2026 about Android malware impersonating FamilyMart (ファミリーマート), the Japanese convenience store chain, distributed from hxxps://hanwgsercassa.eu[.]cc/, tagged…
Poland's national computer emergency response team CERT Polska warned on X on 12 November 2026 about a new SMS campaign in which fraudsters pose as police units, including traffic departments and regional police headq…
CSIRT Italia warns of renewed smishing claiming PagoPA/SEND fines; links lead to send-au.eu.cc to steal logins and card data. PagoPA and SEND are impersonated.
PhishDestroy posted on Mastodon on 12 November 2026 a series of suspected scam domains that, according to its domain records, all show "AI trading platform" pages with account-registration forms collecting names, emai…
PhishDestroy posted on Mastodon on 12 November 2026 that xxvv435[.]weebly[.]com is a phishing page. Its record describes an Onet Poczta login page with email and password fields, flagged by 19 of 92 VirusTotal engines…
PhishDestroy posted on Mastodon on 12 November 2026 that xncok12[.]weebly[.]com is a phishing page. Its record describes a GMX.NET-branded email and password login form, flagged by 17 of 92 VirusTotal engines. GMX is…