Researcher flags fake OKX exchange site dock-okx.com.cn pushing suspicious Android APK
@Malwarehunterr reported on 2 November 2026 that dock-okx.com.cn imitates the OKX exchange and pushes a suspicious Android APK from mithvxrqkpn.com. OKX is not involved, and the APK's purpose is unverified.
- First reported
- Reports
- 1
Source: x.com · published
What happened
Security researcher @Malwarehunterr posted on X on 2 November 2026 that a fake website impersonating the OKX cryptocurrency exchange tricks visitors into downloading a suspicious Android APK, and that its registration button redirects to another suspicious domain. The post lists these indicators of compromise: the fake site dock-okx.com.cn, an APK download at www.mithvxrqkpn.com/upgradeapp/android_ACE532658.apk and a SHA-256 hash for the APK. Neither domain belongs to OKX. The post does not say what the APK does once installed, so its purpose is unverified.
How the scam works
The screenshot in the post shows a Chinese-language page with the OKX logo, navigation menus, a live-looking BTC/USDT price panel and two buttons, one to download the app and one to register. A VirusTotal capture in the same post shows that, at the time, none of the security vendors had flagged dock-okx.com.cn, which is a reminder that a clean scan does not prove a site is safe, especially soon after it appears.
The pattern is a familiar one for crypto scams. A page that copies an exchange's design invites people to install a mobile app from a link instead of an official app store. A trojanised or fake app can then ask for sensitive permissions, show a cloned login screen to collect passwords and codes, or watch what is typed on the phone. The registration button sending visitors on to a second domain suggests a chain of pages, which makes it harder for a single block to stop the scheme.
A real exchange publishes its app through the official stores and its own verified website. An APK downloaded from a web page installs outside the store's checks, and Android asks the user to allow installs from unknown sources first, a setting that should stay off.
Source
@Malwarehunterr on X, post of 2 November 2026 (indicators, screenshot and VirusTotal capture). Not independently verified by scammers.com.
Red flags
- A page copying the OKX design on an unrelated address, dock-okx.com.cn.
- A button that downloads an APK file directly instead of linking to an official app store.
- An APK hosted on a separate unknown domain (mithvxrqkpn.com).
- A registration button that redirects to another suspicious domain.
- An Android prompt asking you to allow installs from unknown sources.
If you were targeted
- 1Do not visit dock-okx.com.cn or install the APK from mithvxrqkpn.com.
- 2Install exchange apps only from Google Play, the Apple App Store or the exchange's own verified website.
- 3If you installed the APK, remove it, run a security scan and change passwords and withdrawal settings from a clean device.
- 4Check exchange accounts for unfamiliar logins, API keys or withdrawal addresses.
- 5Keep the Android setting for installing unknown apps switched off.