Researcher flags t-reff.eu.cc spreading Android malware disguised as dating app HerzTreff
@masaomi346 reported on 1 November 2026 that t-reff.eu.cc distributes Android malware disguised as the dating app HerzTreff. It is a malware lure, not a romance scam; the report rests on one X post.
- First reported
- Reports
- 1
Source: x.com · published
What happened
Japanese security researcher @masaomi346 posted on X on 1 November 2026 that the site t-reff.eu.cc, shown in defanged form in the post, distributes Android malware disguised as HerzTreff, a dating app. The post links a VirusTotal entry for the file with the SHA-256 hash 07f37d654db3ce7a009e2d59833358452d884eb36a4deda9fcc0ad64617f7293, and is tagged #Phishing, #フィッシング詐欺 and #malware. The post does not say who runs the site or how many people have been affected. It is not a romance scam in the usual sense: according to the researcher the dating-app name is a lure to get the malware installed. The claims come from the researcher's post and have not been independently verified.
How the scam works
The screenshots in the post show the site open on a phone in Japanese. It displays the HerzTreff icon, a countdown timer (“remaining time 04:52”) and a notice titled “Attention regarding privacy protection”. The text says the survey will show photos of real users, that all information is used only for matching, and asks the visitor to keep it strictly confidential, with tags such as “please refrain from screenshots”. Buttons for a “keep it secret” option and a “direct download” are visible at the bottom. The timer adds urgency, and the privacy language makes a download feel discreet. Part of the page is covered by a black block that the researcher added.
This is a typical way of delivering Android malware: a dating or adult-themed app is promoted to people through links, and the page asks them to install an APK file from the website, which means turning off Android's protection against apps from outside the official store. The researcher does not say what the malware does once installed. Apps installed this way can request powerful permissions, such as access to messages, contacts or accessibility features, depending on how they are built.
Real dating apps are distributed through the official app stores. A site that insists on a direct download, a countdown and secrecy is a reason to stop.
Source
@masaomi346 on X, post of 1 November 2026 (screenshots and VirusTotal link). Not independently verified by scammers.com.
Red flags
- A site on an unusual domain such as t-reff.eu.cc promoting a “dating app” download.
- A direct APK download button instead of a link to an official app store.
- A countdown timer and warnings about privacy, secrecy and screenshots.
- Instructions to allow installs from unknown sources.
- A link to the app sent in a message or advertisement rather than found in the official store.
If you were targeted
- 1Do not install anything from t-reff.eu.cc; if you did, uninstall the app and scan the phone with a trusted mobile security tool.
- 2Change passwords and PINs from a clean device and tell your bank if you entered financial details after installing it.
- 3Install apps only from the official app store, and keep installs from unknown sources switched off.
- 4Review which apps have access to your messages, contacts and accessibility settings.
- 5Treat unexpected links to dating or adult apps with suspicion, and report them to the platform where you saw them.