Researcher flags mydishisbom.com distributing Android malware disguised as Amazon

What happened

On 5 November 2026 the security researcher @masaomi346 posted on X that the site mydishisbom.com was distributing Android malware disguised as Amazon. The post, written with Japanese phishing and malware hashtags, linked to an analysis and stated that the domain distributes Android malware impersonating Amazon. The domain is not operated by Amazon.

How the scam works

Campaigns of this kind in Japan usually begin with an SMS that claims a parcel could not be delivered or that an Amazon order needs attention, and links to a site on an unrelated domain. Instead of a login form, the page may imitate an app store or download page and invite the visitor to install a tracking or shopping app. Because the file is downloaded from the website, not from the real store, Android has to be told to allow installs from unknown sources.

Malicious Android apps spread this way have commonly been reported to read incoming SMS messages, including bank and card one-time codes, to send further scam texts from the victim's phone, or to show fake login screens over banking apps. Real Amazon tracking happens in the official Amazon app or website, and genuine apps come from Google Play itself. Anyone who installed an app from this site should disconnect the phone from mobile data and Wi-Fi, remove the app, check for any accessibility or device-administrator permissions it was given, and change passwords for accounts used on the phone from a different device. Banks and card issuers should be told if codes may have been read. The domain comes from the researcher's post and has not been independently checked by scammers.com.

Source

Post by @masaomi346 on X, 5 November 2026, flagging mydishisbom.com. Not independently verified by scammers.com.