From our other sites
The story
A case has come to light in which a smartphone was remotely hijacked and PayPay was fraudulently used to drain the victim’s entire bank savings. The attacker reportedly took control of the device through malicious malware — in other words, a fake app. On 5ch forums, many pointed out that the fake app in question was disguised as an adult version of TikTok called “TikTok18+,” and discussion also centered on the fact that the Osaka Prefectural Police had issued a warning about it back in October, and that Toyo Keizai had reported on a similar scheme. Meanwhile, some raised technical doubts about how far a sideloaded app could really control PayPay directly, while others questioned the credibility of the article itself.
10/29 (Thu) 15:31 JST
ENCOUNT
Device remotely controlled via malicious malware (fake app): phone hijacked, bank savings withdrawn
Source: news.yahoo.co.jp / Original article here
What people said
I get they phrased it so idiots could understand, but it'd almost be funny if the "iPhone is safe" narrative got wrecked by a case where the idiot-proof iPhone was the one that got hit.
Or a linked credit card?
Apparently it was auto-charge.
What, did My Number bully you as a kid, or did it steal your girlfriend recently or something?
There's plenty of pushback on how personal data gets handled, not just in Japan but worldwide.
Oh come on, we all know exactly what he was planning to do, lol
So can you even tell whether your appliances are behaving normally?
I keep my money in a bank account that isn't linked to my phone at all. I've already given up on convenience.
I top it up at 7-Eleven.
Guess you don't even need a smartphone then.
Or can it hit PayPay's service API directly?
Even for a sideloaded app, I find it hard to believe it can just do anything to that extent…
Normally, apps cooperating with each other like that shouldn't be possible — it's blocked at the OS level under normal circumstances. Maybe they used that app itself to make the transfer.
This one was downloaded and used on Android, though.
iPhone has also allowed downloading and installing from alternative app stores for about a year now. You can turn it off in settings, and I doubt many people actually use it, but still.
Probably a case where they thought they'd stopped it, but it finished installing in the background anyway. That's usually how it goes with phones.
Yeah, iPhone — the phone even an idiot can use.
>Installed an app that showed up on social media out of curiosity
Even that much is already strange, but
why does the App Store even come into it?
It'd make sense if it were the Google Play Store, though.
But their everyday phone is an iPhone, right? So does that mean they had PayPay installed on a separate Android device at home too?
>While operating an Android device
That's how it reads from the article, anyway.
With this much personal data leaking around, a hijack is plenty possible. There was a TV segment about someone who happened to check their credit report with CIC [Japan's credit information center] and was shocked to find two phones had been bought in their name using their own driver's license, without them even knowing. Apparently the culprit was the one paying the bills, but still, SIM-based fraud is scary.
The Osaka Prefectural Police had already put out a warning about it. And Toyo Keizai [a Japanese business magazine] ran an article saying that app seizes control permissions and runs PayPay in the background. That was October 9th.
I'm skeptical you can actually seize control permissions on current Android like that and then launch other apps with it. And even if you did launch it, PayPay still requires some kind of authentication anyway.
Background and key points of this discussion
Smartphone hijacking scams like this one often start with installing a “sideloaded app” obtained outside the official app stores. The “TikTok18+” app flagged in the thread was a fake app disguised as an adult-content version of TikTok; the Osaka Prefectural Police had already issued a warning about it in October, and Toyo Keizai had reported on a method where PayPay was remotely manipulated through it. Android tends to be the easier target since sideloading can be enabled depending on settings, but many raised technical doubts about how control permissions could even be seized in the first place, given that cross-app interaction is supposed to be restricted at the OS level. With cashless payment apps, some accounts are directly linked to a bank account via auto-charge settings, and this linkage is likely why the damage extended to the victim’s entire savings balance. At the same time, the thread also drifted into back-and-forth bickering over the article’s credibility and the usual iPhone-versus-Android rivalry, making it a mix of genuine technical questions and classic forum squabbling.
*This article is excerpted and summarized from the 5ch (News Express+) thread “Smartphone “Hijacked,” PayPay Fraudulently Used, Entire Savings Withdrawn… Victim Left Stunned: The Method Behind the Fake App.”
Leave a Reply