Executive Summary
In early 2026, researchers uncovered 'Canis C2', a comprehensive surveillance framework primarily targeting Japanese users through smishing and phishing. The campaign impersonates financial and payment services like Paidy, Pay-Easy, and American Express to lure victims into installing malicious applications or profiles. The framework is notable for its cross-platform reach, featuring dedicated agents for Android, iOS, Windows, Linux, and macOS.
Technically, the actor utilizes sophisticated browser-based fingerprinting, including Canvas 2D API rendering to bypass analysis environments, and maintains an operator dashboard with LLM-assisted code. The framework specifically checks for iOS security mitigations like BlastDoor and ImageIO, suggesting intent to deploy high-tier exploits such as ForcedEntry. Beyond mobile devices, the framework includes PowerShell payloads for Active Directory enumeration and bash scripts for Linux persistence.
The threat represents a significant risk to both individual privacy and enterprise security in Japan. The rapid rotation of infrastructure and adoption of Cloudflare proxying after initial exposure indicates a determined and reactive adversary. Organizations should prioritize monitoring for unauthorized Accessibility Services on mobile and unexpected AD enumeration on Windows endpoints.