---
title: Hunt: post-WASABI SWITCH refund phishing — real order metadata + freemail + LINE social-engineering | ctxsec
url: https://ctxsec.com/items/hunt-wasabi-refund-line-phishing
description: ""
status: "hunt idea (vendor-confirmed lure)"
published: 2026-10-16
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-wasabi-refund-line-phishing.md)

hunt idea (vendor-confirmed lure)

2026-10-16

### Hunt: post-WASABI SWITCH refund phishing — real order metadata + freemail + LINE social-engineering

After the Oct 14 WASABI SWITCH intrusion, buyers received freemail messages that included accurate order datetime/product/amount/ship-to and urged LINE contact for a fake refund. Hunt ideas: (1) mail gateway — freemail senders whose bodies match order-confirmation field patterns plus 返金/refund/LINE keywords; (2) endpoint/web — new LINE friend requests or deep-links from mail clients in the hours after a purchase; (3) merchant side — correlate WASABI SWITCH / World Switch API anomaly logs around Oct 14 and ~04:00 JST Oct 16 with outbound data transfers; (4) expand the same lure pattern to other Japan EC platforms disclosing leaks this week.

Sources: [WASABI SWITCH first report](https://wasabi-inc.biz/help/news/20261016-01/)