Security researcher @harugasumi posted on X on 10 November 2026 about suspicious scam emails impersonating Central Research Services (中央調査社) and Japan's Cabinet Office (内閣府), using subjects such as an inquiry about th…
Source: x.com · published
Security researcher @harugasumi posted on X on 10 November 2026 about suspicious scam emails impersonating Central Research Services (中央調査社) and Japan's Cabinet Office (内閣府), using subjects such as an inquiry about the 'Reiwa 8 (2026) 8th survey'. According to the thread, on Android devices the link hxxps://icgsxf[.]com/auth/wheaof/token redirects to hxxps://xinyaojiancai-jp[.]com/, and tapping the Install button downloads a malware APK (survey-gov.apk) served from abused Amazon Web Services URLs. The researcher posted a VirusTotal result for the APK and said non-Android visitors such as iOS users are sent to the genuine Cabinet Office opinion-survey site. The researcher also noted that Central Research Services has posted a warning about the emails on its own website. Central Research Services, the Cabinet Office and Amazon Web Services are spoofed or abused and are not the scammers. Do not install apps from links in survey emails.
Government-survey lures work because the message looks like routine official research. On Android, according to the researcher, the link leads through icgsxf.com to xinyaojiancai-jp.com and an Install button that fetches a harmful APK (survey-gov.apk) from abused Amazon Web Services URLs. Installing that file means allowing apps from outside the official store.
The researcher said people on iOS and other non-Android devices were sent to the genuine Cabinet Office opinion-survey site, which can make the email look legitimate if a recipient checks it on a computer or iPhone first. Central Research Services has, according to the post, published its own warning about the emails. A genuine Cabinet Office or survey firm will not ask you to install an APK from a link in an email. The report comes from a researcher's public thread and has not been independently checked by scammers.com.
Public post on X, 10 November 2026: https://x.com/harugasumi/status/2120019643608002873
The indicators come from this source and have not been independently checked by scammers.com.
Netcraft posted on X on 10 November 2026 a warning about scams riding the hype around Grand Theft Auto VI. Its linked research says sites using the name of the GTA VI leaker "CyberLeek" offer a supposed leaked build:…
Researcher @masaomi346 says tik-tok-18-app-5.top distributes Android malware posing as an adult TikTok app. TikTok is not involved.
Nation Press reported on 11 November 2026 that Kolkata Police's Bhowanipore police arrested three men who allegedly impersonated Central Bureau of Investigation (CBI) officers at the Staff Selection Commission (SSC) o…
The Santa Fe New Mexican reported (published 9 November 2026 at 11:15 PM MT, 1:15 AM ET on 10 November) that Sandra Vega, 48, of Pecos, a former employee of New Mexico's First Judicial District Attorney's Office, plea…
Japanese threat-intelligence account Metemcyber posted on X on 11 November 2026, crediting the researcher team NA4Sec, a phishing site at hxxps://nuvexalora[.]cfd/drgsdfbdr/#/index posing as the customer login page of…
The Metemcyber account posted on X on 11 November 2026, with credit to Team NA4Sec, a phishing site targeting Japan that impersonates Matsui Securities (松井証券), the Japanese online brokerage, at hxxps://orvexilium[.]cf…