Researcher flags rongjuekeji.com as Android-malware site impersonating Sumitomo Mitsui Card

What happened

Japanese security researcher @masaomi346 posted on X on 3 November 2026 about hxxps://rongjuekeji.com/, which he describes as Android malware impersonating Sumitomo Mitsui Card (三井住友カード, SMBC Card). The post adds, in a note in brackets, that no malware was delivered when he checked. It is tagged #Phishing, #フィッシング詐欺 and #malware and includes three phone screenshots. The domain is not an SMBC Card address, and the post does not say what the file would do if it were delivered.

How the scam works

The first screenshot shows a green SMBC Card page with the company's name, a Vpass ID member menu and a login form. It has fields for an ID and a password, a green login button, a link for people who cannot log in, and a button to register a new Vpass ID. The address bar shows rongjuekeji.com. Vpass is the real online service for SMBC Card holders, so the page looks like a copy of the member login.

The researcher's note means that the site did not hand out the malicious Android file at the time of his visit. Pages like this are often set up to deliver a file only to certain visitors, such as people using an Android phone or arriving from a particular link, or only for a short period. A visit that returns nothing therefore does not prove that the site is harmless, and the page still collects whatever is typed into its login form.

A message claiming to be from a card company, with a link to a login page or an app, is the usual starting point. The visitor is told to confirm an account, update the app or fix a security issue. The operators can then use stolen login details or install software that watches the phone. The post does not describe how the link was sent, who received it or whether anyone lost money.

Source

@masaomi346 on X, post of 3 November 2026 (address and screenshots). Not independently verified by scammers.com.