Researchers uncover Canis cross-platform surveillance framework targeting Japan

Apr 8, 2026 · Original article ↗

Summary

Hunt.io researchers found an exposed, unauthenticated C2 and source code for Canis, a cross-platform surveillance framework delivered through Japanese-themed phishing. Its API was secured on March 21, while related phishing infrastructure appeared afterward.

Key points

A phishing page impersonating Japanese payment services urged visitors to install a malicious Android app, Device Shield, to view a fabricated bill.
The app abused Android Accessibility Services for input capture, screen capture, and keylogging, then checked in with Canis C2.
An unauthenticated API exposed C2 endpoints, command logs, payloads, and source code. Logs showed two device IDs; one appeared likely to belong to the operator testing the system.
Canis included agents or payloads for Android, iOS, Windows, Linux, and macOS, with commands for surveillance, credential collection, and system access.
Browser-based fingerprinting and delivery-validation code assessed devices and referenced iOS protections including BlastDoor and ImageIO; researchers did not recover exploit code.
Windows payloads included PowerShell Active Directory enumeration, while Linux scripts could establish persistence through a systemd service.
The API was secured on March 21, but researchers observed a new phishing domain afterward. The investigation identified 161.33.154[.]144 and multiple related domains.

Article Details

Attack Vectors: Japanese-language phishing pages impersonate payment services and present fabricated electric bills that require installation of a malicious APK and granting device permissions.
Smishing is assessed as a likely delivery vector based on a mobile-browser screenshot, but the researchers did not observe messages distributing the phishing domain.
The malicious APK abuses Accessibility Services for keylogging, screen capture, GUI input capture, and input injection, and requests battery optimization permissions to support background operation.
A browser-based agent supports credential overlays, GPS tracking, camera and microphone capture, and arbitrary code execution through a registered ServiceWorker.
A fictional dog-photo competition page silently collects device fingerprints and registers visitors with the controller.
Recovered desktop payloads include credential-seeking and Active Directory enumeration code, alongside Linux/Unix reconnaissance and persistent service installation.
Recovered delivery-validation code evaluates operating-system-specific delivery options and iOS security barriers. Researchers did not recover exploit code; the proposed connection to ForcedEntry remains an assessment rather than a confirmed exploit implementation.
A follow-on credit-card phishing page contains proxy and capture endpoint references consistent with continued credential-harvesting activity.
Defensive Notes: Enable Lockdown Mode for high-risk iOS users.
Block recently registered domains and investigate domains registered through the identified registrar that resolve to the observed hosting network in Japan.
Monitor unapproved APKs requesting Accessibility Services permissions.
Investigate periodic outbound polling to unknown hosts, especially POST requests involving /api/agent/heartbeat or /api/agent/commands.
Audit directory environments for unexpected enumeration activity.
Educate users about payment-urgency phishing and requests to install applications outside official stores to view bills or documents.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`americanexpress-site[.]com`	Follow-on Japanese-language credential-phishing domain found on the same server after the exposed API was secured.
DOMAIN	`android-protect[.]com`	Domain assessed with moderate confidence as related to the activity through registration, nameserver, and hosting similarities.
DOMAIN	`applesecurity[.]pro`	Suspected related domain assessed with moderate confidence; historical scans returned a fake iOS security configuration page.
DOMAIN	`devicesecurity[.]pro`	Domain assessed with moderate confidence as related to the activity through registration, nameserver, and hosting similarities.
DOMAIN	`info-payeasy[.]com`	Initial phishing and C2 domain delivering the malicious APK and receiving agent registration, polling, and heartbeats.
DOMAIN	`ios-deviceprotect[.]com`	Domain assessed with moderate confidence as related to the activity through registration, nameserver, and hosting similarities.
DOMAIN	`ios-inc[.]app`	Suspected related domain assessed with moderate confidence; historical scans returned a fake iOS security configuration page.
DOMAIN	`iosdevicepolicy[.]app`	Domain assessed with moderate confidence as related to the activity through registration, nameserver, and hosting similarities.
IPV4	`161[.]33[.]154[.]144`	Server hosting the initial phishing domain, exposed C2 interfaces, and follow-on phishing infrastructure.
IPV4	`34[.]111[.]179[.]208`	Shared hosting address explicitly listed as an indicator for six suspected related domains parked there before activity commenced.
SHA256	`564b381dc3e6fc737fd9b46fb5ee1e06f4e333d2886f0805514af44947a4c271`	Hash listed for PayEasy-Viewer.apk, the malicious Android APK that initiated the investigation.
SHA256	`f8e9a720468c89f191d8cb12d46d81ef67b87a9ef95a307835c556a0885bd181`	SHA-256 fingerprint of the Let's Encrypt certificate issued for the initial phishing domain.