Malicious Mobile Campaign Targeting China

Webamon Research reports a high-priority, active phishing campaign targeting users in China that ran for 184 days (Jul 7, 2025–Jan 7, 2026), leveraging adult-themed landing pages to prompt installation of malicious Android/iOS apps. The operation deployed over 70,000 domains across two distinct Webamon fingerprints (primary: be9f69..., early: a9af72...), exhibited strong page consistency, and showed dramatic registration spikes in late 2025; immediate forensic analysis of the apps and prioritised mitigation of the domain infrastructure are recommended.