Chinese Man Arrested for Rogue Cell Tower Linked to Phishing Scheme in Tokyo

English.Kyodonews

Chinese Man Arrested for Rogue Cell Tower Linked to Phishing Scheme in Tokyo

First seen 9 Nov 2026, 08:49 UTC • •42.0

Article Content

1 / 4

Browse articles

ThreatCluster •November 9, 2026 at 08:50 UTC

•Yu Hai was arrested for operating an unlicensed rogue cell tower in Tokyo.
•The rogue tower is suspected to be linked to a phishing scheme targeting tourists.
•Police have been investigating similar incidents since January 2025.

A 31-year-old Chinese man, Yu Hai, was referred to prosecutors for allegedly operating an unlicensed rogue cell tower in Tokyo's Ginza district, disrupting services of NTT Docomo. He was arrested while using an IMSI catcher from a parked car, emitting signals to interfere with mobile communications. Police suspect the device was part of a phishing scheme targeting foreign tourists, as suspicious text messages in Chinese were reported since January 2025. The communications ministry had previously warned the public about fake base stations affecting mobile services. Yu has denied the allegations, and police are investigating the extent of the phishing operation linked to his activities.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 7h ago How this analysis works

Timeline

2025-01-01

Suspicious text messages reported

Foreign tourists began receiving phishing text messages in Chinese, prompting police investigation.

2026-11-07

Yu Hai arrested

Yu Hai was arrested for allegedly operating a rogue cell tower in Ginza, disrupting mobile services.

2026-11-09

Referred to prosecutors

Yu Hai was referred to prosecutors for his actions, which violate Japan's Radio Law.

More articles in this cluster (3)

Threat Graph

7 entities, 12 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Phishing
T1566.002 - Spearphishing Link
T1566 - Phishing

Affected Platform (4)

2G
4G
5G
IMSI Catcher

Relationships

Phishing targets 2G
Phishing targets 4G
Phishing targets 5G
Phishing targets IMSI Catcher
T1566.002 - Spearphishing Link targets 2G
T1566.002 - Spearphishing Link targets 4G
T1566.002 - Spearphishing Link targets 5G
T1566.002 - Spearphishing Link targets IMSI Catcher
T1566 - Phishing targets 2G
T1566 - Phishing targets 4G
T1566 - Phishing targets 5G
T1566 - Phishing targets IMSI Catcher

Common questions

What device was used in the attack?

The suspect allegedly used an IMSI catcher to disrupt mobile services and collect phone identifiers.

Who is affected by this incident?

Foreign tourists in Tokyo's Ginza district were primarily targeted by the phishing messages.

What should users do if they receive suspicious messages?

Users are advised to avoid opening unfamiliar messages and to leave areas with unstable phone service.

Continue Reading

Volt Typhoon's Silent Train Network Targets US Critical Infrastructure The Chinese state-sponsored hacking group Volt Typhoon has been linked to a covert network called Silent Train, which has exploited at least four zero-day vulnerabilities over three years. This network utilizes rapidly rotating chains of compromised SOHO routers, IoT devices, and enterprise infrastructure to access…

GitLab Issues Emergency Patch for Critical RCE Vulnerability GitLab has released emergency patches for a critical remote code execution vulnerability, CVE-2026-97229, affecting its Community and Enterprise Editions. This flaw, stemming from an integer overflow in the CI/CD regular expression compiler, allows unauthenticated attackers to execute arbitrary code via specially…