Researcher @Malwarehunterr says samsung2026.sbs and related hosts collect Samsung logins and run clipboard-hijack JS that swaps crypto wallet addresses. Samsung is not involved.
Source: x.com · published
On 8 November 2026 the security researcher @Malwarehunterr posted on X about a Samsung-branded website targeting Tajikistan (+992) that collects login credentials and serves a modified jquery-1.11.3.min.js containing crypto clipboard-hijacking code that replaces copied wallet addresses. The post listed Samsung-related domains samsung2026[.]sbs, ssamsung1[.]xyz and samsung2026[.]lol, and said other sites including a-guci[.]top, dule[.]wang, mikimoto[.]asia, dunlop-ya[.]top and epicvip[.]top serve the same malicious JavaScript. It listed the malicious jquery path on samsung2026.sbs and a URLScan scan ID, and tagged the finding #Phishing and #CryptoScam. These hosts are not operated by Samsung, and Samsung is not involved.
The researcher's screenshot of samsung2026.sbs/login/index shows a Tajik-language Samsung welcome page with the +992 country code pre-filled for a phone-number login and a password field. Entering credentials on that page hands them to whoever runs the site. Separately, the modified jQuery file listens for copy events: when a visitor copies what looks like a Bitcoin, Ethereum, TRON or similar wallet address, the script silently replaces it with one of the attacker's addresses listed in the post, so the next paste sends funds to the wrong wallet.
Brand lookalike sites of this kind are typically reached through search ads, messages or links promising account help, a warranty claim or a device offer. Because the clipboard hijack runs in the browser, it can affect people who never sign in at all, if they visit the page while transferring cryptocurrency. The researcher also listed wallet addresses for TRX, ETH and BTC associated with the campaign, and a URLScan scan ID for the samsung2026.sbs login page rather than a clickable link.
Use only the official Samsung app or samsung.com typed yourself for account access. Anyone who entered details on these hosts should change their Samsung password and any reused passwords, enable two-step verification, and treat any crypto transfer made around the same time as potentially redirected. Do not paste wallet addresses into a transfer without checking them character by character. The details come from the researcher's post and have not been independently checked by scammers.com.
Post by @Malwarehunterr on X, 8 November 2026, on samsung2026.sbs and related hosts. Not independently verified by scammers.com.
Security researcher @KesaGataMe0 posted on X on 12 November 2026 that hxxps://smbc[.]hocxiu[.]com/ is a phishing site impersonating SMBC (Sumitomo Mitsui Banking Corporation, 三井住友銀行), served through Cloudflare (AS1333…
PhishDestroy posted on Mastodon on 12 November 2026 that xncok12[.]weebly[.]com is a phishing page. Its record describes a GMX.NET-branded email and password login form, flagged by 17 of 92 VirusTotal engines. GMX is…
PhishDestroy posted on Mastodon on 12 November 2026 that xfinitywebmailw3r[.]weebly[.]com is a phishing page. Despite the Xfinity name in the address, its record describes a Network Solutions-branded webmail login for…
The phishing feed @PhishStats posted on X on 12 November 2026 a new phishing URL, hXXps://portal[.]stpmex[.]br[.]com/spei/login/, hosted at 217.151.99.216 (M247 Europe SRL, AS9009, Romania). The hostname and path use…
Security researcher @catnap707 posted on X on 12 November 2026 about fake websites (偽サイト) impersonating the Tokyo Metropolitan Police Department (警視庁). The post lists the links jp[.]kdfz[.]net, jp[.]kstw[.]net, jp[.]k…
PhishDestroy posted on Mastodon on 12 November 2026 that xxvv435[.]weebly[.]com is a phishing page. Its record describes an Onet Poczta login page with email and password fields, flagged by 19 of 92 VirusTotal engines…