Massive Phishing Campaign Targets Japanese Users in Tech Support Scam Surge

TOKYO — A sophisticated threat actor group has launched a massive phishing campaign targeting individuals and organizations across Japan, sending more than 13 million fraudulent emails designed to extract financial payments through fake technical support services. The attack wave was detected on July 23, 2026, marking one of the largest coordinated scams directed at Japanese internet users in recent years.

The malicious emails utilize spoofed sender addresses that mimic legitimate technology companies and government agencies, creating a false sense of urgency for recipients. Messages warn victims of critical security breaches or system failures on their devices, urging immediate action to prevent data loss. When users click links within the messages, they are redirected to counterfeit alert websites designed to look like official support portals.

These fake sites prompt visitors to call specific phone numbers listed as emergency technical hotlines. Once connected, fraudsters pose as IT specialists and convince victims that their computers or networks have been compromised by malware. The scammers then guide users through a process of granting remote access to their machines under the guise of performing repairs. During these sessions, attackers install malicious software, steal sensitive credentials, and demand payment for non-existent services.

The primary objective of the campaign is financial gain. Victims are coerced into paying substantial fees for fraudulent repair work or subscription-based security packages that provide no actual protection. In some instances, scammers have reportedly accessed banking applications on compromised devices to transfer funds directly from victims' accounts before disconnecting.

Security experts warn that the sheer volume of emails sent suggests a highly automated operation capable of bypassing standard spam filters initially used by many Japanese enterprises and consumers. The campaign specifically targets both personal users and corporate environments, exploiting the high reliance on digital infrastructure in Japan's economy. Organizations are advised to review their email filtering protocols and educate employees about the risks of unsolicited technical support requests.

While the scale of the operation is clear, the specific identity of the threat actors behind the attack remains unconfirmed. Authorities have not yet announced any arrests or identified a specific criminal syndicate responsible for distributing the 13 million messages. It is also unclear whether the attackers are operating from within Japan or utilizing infrastructure located in other jurisdictions to mask their location.

As investigations continue, cybersecurity firms are tracking variations of the phishing templates and alert sites used in the campaign. The duration of the attack remains unknown, with no indication that the threat actors have ceased operations. Officials urge residents and businesses to remain vigilant against unsolicited calls regarding computer issues and to verify any technical support requests through official company channels before taking action.