Researcher flags cachedpage-jp.com pushing Android malware disguised as a subsidy portal
A researcher, @masaomi346, reported on 31 October 2026 that cachedpage-jp.com serves Android malware disguised as a subsidy portal, with a store-style install page. The report comes from one X post and has not been independently verified.
- First reported
- Reports
- 1
Source: x.com · published
What happened
A security researcher posting as @masaomi346 on X reported on 31 October 2026 that the site cachedpage-jp.com distributes Android malware disguised as a subsidy (grant) portal. The post, written in Japanese and tagged #Phishing and #malware, gives the address in defanged form (hxxps://cachedpage-jp.com/) and links to a VirusTotal page for a file with the SHA-256 hash 99708308b299112e76ffc2e856e76443cad324da3a14f0755c44c136266b4256. The post does not explain who runs the site. The researcher's account is the source for the claims here.
How the scam works
The screenshot attached to the post shows the site opened on a phone. It imitates an app-store listing for an app named 補助金ポータル (Subsidy Portal), with an “Install” button, a star rating, a claim of more than a million downloads, and a row of illustrated steps. The steps tell the visitor to tap “update”, to confirm a connection by tapping “OK”, and to switch on a permission that allows installation of apps from outside the store. Those figures and the store-style layout appear on the scam page itself and cannot be taken as real.
The design is a typical social-engineering lure. People searching for government subsidies or grants are a natural audience, and a polished page that looks like a store entry encourages them to install an APK file directly. Android normally blocks apps that come from outside the official store, so the page walks users through turning that protection off. Once an app is installed this way it can request access to messages, contacts, accessibility features or overlays, depending on what the malware is built to do. The researcher's post does not say which of those this sample uses.
No official Japanese subsidy portal asks people to install an app from a web page, and genuine government services are reached through the official sites of the ministries or local governments concerned.
Source
@masaomi346 on X, post of 31 October 2026 (screenshot and VirusTotal link). Not independently verified by scammers.com.
Red flags
- A site offering an Android app for download from a web page instead of the official store.
- A “subsidy portal” or grant app from an unfamiliar domain such as cachedpage-jp.com.
- A page copying an app-store layout, with high download counts and ratings you cannot verify.
- Step-by-step instructions to allow installs from unknown sources.
- Permissions requests that do not fit a simple information app.
If you were targeted
- 1Do not visit cachedpage-jp.com or install anything from it.
- 2If you installed it, turn off network access, uninstall the app, run a scan with a trusted mobile security tool and change passwords from a clean device.
- 3Tell your bank if you entered card or banking details on your phone after installing it.
- 4Install apps only from the official store, and keep installs from unknown sources switched off.
- 5Check subsidies only through official ministry or local-government sites that you type yourself.