The Intruder in the Palm of Your Hand
The smartphone was certainly in her own hand. But she was not the one controlling it. Cybercrime: Malice in Everyday Life — Part 4 You don't have to be someone special to be targeted. Everyday life has unseen point
The smartphone was certainly in her own hand. But she was not the one controlling it.
Cybercrime: Malice in Everyday Life — Part 4
You don't have to be someone special to be targeted.
Everyday life has unseen points of entry. Drawing on publicly available information, we trace how these threats unfold quietly and how their consequences eventually surface in everyday life.
An Everyday Smartphone
Devon was relaxing at home after finishing work.
After dinner, she sat on the sofa and browsed her smartphone. Checking social media and watching videos were part of her usual routine.
That day, an advertisement caught her attention.
It promoted a special adult-oriented app using the name of a popular video service.
The app promised access to content that was not available in the regular version.
Curious, Devon opened the link in the ad.
A page introducing the app appeared, along with instructions for downloading it.
She could not find it in the official app store, but assumed that was because it was a special edition.
She followed the instructions on the screen and proceeded with the download and installation.
The app asked her to change a few settings along the way, but she assumed they were necessary to use it.
Then she tried playing a video.
Suddenly, the screen went completely black.
She tried a few things, but it would not display properly.
"That's strange. Maybe it isn't working properly."
Devon closed the app.
She did not give it much more thought. She watched another video, exchanged messages with her family, and spent the rest of the evening as usual.
Her smartphone remained in her hand, just as it always had.
A Payment Made Without Her Knowledge
A few days later, Devon noticed something unusual involving her mobile payment service.
There was a transaction she did not recognize.
When she checked, she found that ¥600,000 had been transferred without authorization from the bank account linked to her cashless payment service to an account she did not know.
She had not made the transaction herself.
She had not lent her smartphone to anyone.
Nor had she given anyone her bank password.
What on earth had happened?
Devon thought back to the app she had installed a few days earlier.
It had not simply been an app for playing videos.
A malicious program had entered her smartphone, putting it in a state where a third party could control it remotely.
Without Devon knowing, information on her smartphone had been read, and the operations needed to make the payment had been carried out.
No one had stolen her wallet.
No one had stolen her bank card.
The smartphone in her own hand had been used by someone else, without her knowledge or consent.
A Tactic Also Seen in Japan
Apps distributed with malicious intent and used to cause harm, including financial losses, are often described as malicious apps, fake apps, or malware.
Remote control through malicious apps like the one described here has also been confirmed in Japan.
On October 15, 2026, the Japan Cybercrime Control Center (JC3) published an alert about this tactic and updated it on November 2. The method involves directing users from social media advertisements or emails to fake apps, then remotely controlling their smartphones to make unauthorized transfers or payments.
On November 4, the Ehime Prefectural Police announced that 27 incidents involving the same kind of tactic had been identified in the prefecture, with losses totaling approximately ¥7.3 million. One case involved a man in his sixties who installed an app called "TikTok18+" after seeing a social media advertisement; approximately ¥600,000 was then transferred without authorization from his bank account.
On November 10, it was reported that a joint investigative team involving police from Fukuoka, Hyogo, and Hokkaido had arrested two people on suspicion of remotely controlling smartphones through malicious apps and fraudulently using electronic payment services. The allegations included remotely controlling the smartphone of a man in his sixties in Hyogo Prefecture and obtaining trading cards worth approximately ¥570,000 from a store in Fukuoka City.
According to the National Police Agency of Japan, approximately 1,600 consultations about similar tactics had been received nationwide by the end of September. These were consultation cases, not necessarily confirmed incidents or a count of victims.
Turning Interest into an Entry Point
A fake app does not always arrive with an obviously suspicious notice telling someone to install an unfamiliar program.
The examples cited by JC3 include emails promising reward points or refunds, and social media ads promoting special editions of popular video services. Appeals such as "get a good deal" or "see something you can't normally watch" can lead users through a continuous path: from an advertisement to an introduction page, and from there to an app download.
Using people's interests, expectations, and trust to guide them into taking each step themselves is a form of social engineering. Devon had not been ordered to do anything by a stranger who suddenly appeared. She had simply opened an advertisement that caught her attention and followed the instructions.
The Permissions Granted to the App
With this type of attack, after getting someone to install an app, the attacker may persuade them to grant powerful permissions that allow the device to be controlled.
Android's Accessibility features are designed to make devices easier to use, for example by reading what is on the screen aloud or assisting with device operation. But if a malicious app is granted access to these features, it may be able to read information displayed on the screen or operate the device on the user's behalf.
[Install a fake app]
|
v
[Grant Accessibility
or similar access]
|
v
[Device controlled
remotely]
|
v
[Information obtained /
payments misused]
An app's appearance does not reveal what may be happening behind it. The permissions requested after installation can also become an entry point for this kind of harm.
Android and iPhone: What's Different?
In the fake-app cases confirmed so far, a notable feature is that users of Android devices are directed to install apps from outside official app stores, after which powerful permissions such as Accessibility are abused.
On an iPhone, an Android APK cannot be installed in the same way, and remote control through Android's Accessibility features does not work in the same manner.
That does not mean iPhones have no risks of their own. Other methods include phishing attacks aimed at stealing Apple Account credentials, and abuse of configuration profiles that add settings for VPNs, certificates, or device management.
Installing a configuration profile does not, by itself, give a third party unrestricted control of an iPhone. The mechanisms are different from those used by malicious Android apps, but it is still important not to accept apps or settings simply because an unfamiliar source directs you to do so.
The Smartphone Was Still in Her Hand
Devon had not handed her smartphone to anyone. She had not shared her password either.
The device had remained in her possession the entire time.
When had the phone in her own hand stopped being hers alone?
References
Japan Cybercrime Control Center (JC3), "Financial Harm Caused by Installing Fake Apps — Beware of App Installations That Exploit the Desire to 'Get a Good Deal' or 'See Something Special,'" published October 15, 2026; updated November 2, 2026. (Japanese-language source.)
https://www.jc3.or.jp/threats/examples/article-719.htmlEhime Prefectural Police, "Cybercrime Division" (information and warnings concerning unauthorized transfers involving fake apps such as "TikTok18+"). (Japanese-language source.)
https://www.police.pref.ehime.jp/cyber/index.htmEhime Asahi Television, "Unauthorized Transfers Continue in Ehime Prefecture; Losses Exceed ¥7 Million," November 4, 2026. (Japanese-language news report.)
https://eat.jp/eat/?ehimenews=ehimenews466847673020261104Kyodo News, "Two Chinese Nationals Arrested on Suspicion of Remotely Controlling Smartphones Through Malicious Apps; First Case Nationwide," November 10, 2026. (Japanese-language news report, republished by Livedoor News.)
https://news.livedoor.com/article/detail/32780270/Jiji Press, "Smartphones Remotely Controlled Through Malicious Apps; Chinese National Arrested on Fraud Charges — Fukuoka Prefectural Police," November 10, 2026. (Japanese-language news report, republished by mixi News.)
https://news.mixi.jp/view_news.pl?from=pickup_news&id=9022769&media_id=4Osaka Prefectural Police, "Beware of the Fake App 'TikTok18+'!" (Japanese-language source.)
https://www.police.pref.osaka.lg.jp/seikatsu/saiba/cyber_shiryou/cybersecurity_tsushin/8/24774.htmlApple Support, "Install Configuration Profiles on iPhone, iPad, and Apple Vision Pro."
https://support.apple.com/ja-jp/102400
This story is a reconstruction based on information published by JC3 and the Ehime Prefectural Police, as well as reported cases. The protagonist's identity and conversations are fictional. The story does not reproduce the full actions of any specific victim.
Institutional note: JC3 (the Japan Cybercrime Control Center), the Ehime Prefectural Police, the Osaka Prefectural Police, and the National Police Agency are Japanese organizations. Ehime Asahi Television, Kyodo News, and Jiji Press are Japanese news organizations. The cited reports and police materials are in Japanese; Apple Support is Apple's official support documentation.
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.