Android malware posing as Sumitomo Mitsui Card served via Google Drawings
Researcher masaomi346 reported Android malware disguised as Sumitomo Mitsui Card (SMBC Card), linked from a Google Drawings page, on October 13, 2026.
- First reported
- Reports
- 1
Source: x.com · published
What happened
In a post on X on October 13, 2026, security researcher masaomi346 reported Android malware disguised as Sumitomo Mitsui Card (SMBC Card). The post linked a Google Drawings page (docs.google.com/drawings/d/1lxz7iR19LEtZYWIs66UexxOpvUO2Cny3riKdBlKqy4w/preview) and a VirusTotal entry for the malware sample, and tagged it as phishing and malware.
Google's platform was abused to host the lure; Google and the card company were not involved.
How the scam works
Hosting a lure on a trusted service such as Google Drawings helps a link get past filters and look safe. A page like this typically shows a button or image directing the victim to download an "app" from outside the Google Play Store.
Malicious banking apps installed this way can request permissions to read text messages or overlay other apps, letting attackers capture login details and one-time codes.
Note: this report is based on a short public post on X. The "How the scam works" section describes how this type of scam generally operates; it does not add details about this specific site beyond what the post says.
Source
masaomi346 (@masaomi346) on X, October 13, 2026.
Red flags
- Being asked to install a bank or card app from a link instead of the official app store.
- Your phone warning about installing apps from unknown sources.
- A Google Docs or Drawings link sent in a text that claims to be from your card company.
If you were targeted
- 1Install banking and card apps only from the Google Play Store or Apple App Store.
- 2If you installed an app from this link, disconnect from the internet, uninstall it, and run a security scan.
- 3Change your card company and email passwords from a clean device, and call the card company using the number on your card.
- 4Report the link to Google via its abuse reporting form.