Researcher flags christmasgif-jp.com pushing Android malware disguised as Japan's e-Tax
@masaomi346 reported on X on 3 November 2026 that christmasgif-jp.com copies a Google Play listing for Japan's e-Tax app and offers Android malware. The post does not say what the file does, and the tax agency is not involved.
- First reported
- Reports
- 1
Source: x.com · published
What happened
Japanese security researcher @masaomi346 posted on X on 3 November 2026 about a site at hxxps://christmasgif-jp.com/ that he describes as Android malware disguised as e-Tax, the electronic tax filing system of Japan's National Tax Agency. The post links a VirusTotal page for a file with the SHA-256 hash a52ed8094ba5bc976b4a21c69165e4f232af65ba899ef91b45a5d45e7d63b047 and is tagged #Phishing, #フィッシング詐欺 and #malware. The post does not say what the file does once installed, so its behaviour is unverified here.
How the scam works
The phone screenshot in the post shows a page laid out like a Google Play app listing for “e-Tax国税庁アプリ” (e-Tax National Tax Agency app). It shows the e-Tax logo, a 4.8 star rating from about 48,000 reviews, a claim of more than 500,000 downloads, a green Install button, three step-by-step screenshots and a “Data safety” section that says no data is shared with third parties. The address bar shows christmasgif-jp.com, not Google Play, so the listing is a copy made to look like an official app store page.
This is a common pattern for Android malware. A message about a tax refund or overdue tax directs people to a page that looks like an app store and offers a file that is installed outside the real store. Android normally warns before installing apps from outside the store, and the step-by-step images on pages like this often show how to switch that warning off. The researcher has not published what the file requests or steals, so it is not possible to say here what harm it could cause.
The National Tax Agency runs e-Tax and its official sites use Japanese government domains. A domain with a name like christmasgif-jp.com has no obvious link to the agency.
Source
@masaomi346 on X, post of 3 November 2026 (address, VirusTotal link and screenshot). Not independently verified by scammers.com.
Red flags
- A page that copies a Google Play listing for the e-Tax app on the unrelated domain christmasgif-jp.com.
- An app download offered outside Google Play, with an Install button on a lookalike page.
- Impressive ratings and download counts that cannot be checked on a copied page.
- A government tax service tied to an odd name that has nothing to do with taxes.
- Instructions on the page for allowing installs from unknown sources.
If you were targeted
- 1Do not install any file from christmasgif-jp.com.
- 2Download e-Tax apps only from the official Google Play or App Store listing linked from the National Tax Agency's own website.
- 3If you installed it, turn off the network, remove the app, run a security scan and change passwords from a clean device.
- 4Check your bank and card accounts for unfamiliar activity and tell your bank if you entered any details.
- 5Report the site to the National Tax Agency or the Japanese police.