Researcher flags mackdentistr-jp.com distributing Android malware disguised as Amazon
Researcher @masaomi346 says mackdentistr-jp.com serves Android malware disguised as an Amazon tracking app on a fake Google Play page. The post gives a VirusTotal SHA-256 hash for the file.
- First reported
- Reports
- 1
Source: x.com · published
What happened
On 4 November 2026 the security researcher @masaomi346 posted on X that the site mackdentistr-jp.com was distributing Android malware disguised as Amazon. The post, written in Japanese, described it as Android malware posing as Amazon and included a link to a VirusTotal entry for the file, with SHA-256 hash 4e472f1a5d14cf690e18943c0fede03185b0faf82429b7ac1ee81e5b7639139c. A screenshot attached to the post shows a page styled like a Google Play store listing for an app called Amazon tracking, with an Install button, while the browser address bar shows mackdentistr-jp.com rather than play.google.com.
How the scam works
Campaigns of this kind in Japan usually begin with an SMS that claims a parcel could not be delivered or that an Amazon order needs attention, and links to a site on an unrelated domain. Instead of a login form, the page imitates the Google Play store and invites the visitor to install a tracking app. Because the file is downloaded from the website, not from the real store, Android has to be told to allow installs from unknown sources, and the page may walk the user through doing that.
The researcher did not describe what the app does once installed. Malicious Android apps spread this way have commonly been reported to read incoming SMS messages, including bank and card one-time codes, to send further scam texts from the victim's phone, or to show fake login screens over banking apps. Real Amazon tracking happens in the official Amazon app or website, and genuine apps come from Google Play itself. Anyone who installed an app from this site should disconnect the phone from mobile data and Wi-Fi, remove the app, check for any accessibility or device-administrator permissions it was given, and change passwords for accounts used on the phone from a different device. Banks and card issuers should be told if codes may have been read. The domain and hash come from the researcher's post and have not been independently checked by scammers.com.
Source
Post by @masaomi346 on X, 4 November 2026 (5:34 AM ET), with a screenshot of the page. Not independently verified by scammers.com.
Red flags
- A text or link that offers an Amazon tracking app outside the official store.
- A page styled like Google Play on a domain that is not play.google.com.
- A request to allow installs from unknown sources.
- An app asking for SMS, accessibility or device-administrator access.
- Delivery-problem messages that push you to act quickly.
If you were targeted
- 1Do not install apps from links in texts or from websites; use the official Google Play store.
- 2Keep install unknown apps switched off on Android.
- 3If you installed the app, disconnect the phone, uninstall it and remove any admin or accessibility permissions.
- 4Change passwords from another device and tell your bank if SMS codes may have been read.
- 5Report the text to your mobile carrier and the domain to Amazon.