Researcher flags cb-customa.com Android malware posing as online refund
Researcher @masaomi346 says cb-customa.com and sister domains push Android malware disguised as an online refund app on a fake Google Play page. Google is not involved.
- First reported
- Reports
- 1
Source: x.com · published
What happened
On 7 November 2026 the Japanese security researcher @masaomi346 posted on X that Android malware posing as an online refund system (オンライン返金システム) was being distributed from hxxps://cb-customa.com/downcb, with the same /downcb path on cb-customb.com, cb-customc.com and cb-customd.com. The post linked a VirusTotal analysis of the sample and was tagged #Phishing, #フィッシング詐欺 and #malware. Follow-up replies the same day listed additional /downcb hosts.
How the scam works
The researcher's screenshot shows a phone browser on cb-customb.com displaying a page made to look like a Google Play listing for an app called オンライン返金システム, with a money-bag icon, a 4.8-star rating, more than 500,000 downloads and a green install button. Its preview images walk the visitor through switching on the Android setting that allows apps from unknown sources and confirming the installation. Google Play is impersonated and is not involved: the page is an ordinary website, and the file is a direct download that bypasses the official store's checks.
Refund lures work because they promise money back rather than asking for payment. Victims may be told by text, phone or chat that they are owed a refund or compensation and that they need a special app to receive it. Malicious Android apps spread this way have commonly been reported to request accessibility or SMS permissions, read bank one-time codes, overlay fake login screens on banking apps or give the operators remote control of the phone.
Genuine refunds are paid back through the original payment method or the company's own official app. Anyone who installed this app should switch the phone to airplane mode, uninstall it, remove any accessibility or device-administrator rights it was granted, change banking and email passwords from another device and tell their bank. The domains and sample come from the researcher's post and have not been independently checked by scammers.com.
Source
Post by @masaomi346 on X, 7 November 2026, flagging cb-customa.com and related /downcb hosts. Not independently verified by scammers.com.
Red flags
- A refund or compensation that requires installing a special app.
- A Google Play-style page on an unrelated domain such as cb-customb.com.
- Instructions to allow installs from unknown sources.
- An app that asks for accessibility, SMS or device-administrator access.
If you were targeted
- 1Install apps only from the real Google Play app, never from website links.
- 2Keep the setting that allows unknown apps switched off.
- 3If you installed the app, disconnect the phone, uninstall it and remove its permissions.
- 4Change banking and email passwords from another device and tell your bank.
- 5Report the link to your mobile carrier or national cyber reporting service.