tokens: Infection chain The threat actors behind this version used several fake websites as their host — copying that of a Japanese mobile phone operator ’ s website in particular — to trick users into downloading the fake security Android application package ( APK ) .