Microsoft impersonating scam: Fake security scans, real data loss
Recently, information security experts have discovered a sophisticated phishing campaign masquerading as security scanning websites impersonating Microsoft. By issuing alarming error warnings, cybercriminals not only trick users into manually removing the antivirus software protecting their computers, but also covertly steal sensitive information and transmit all of this data via the Telegram platform.
Security alert impersonation tactics
According to reports from Malwarebytes, a refund scam scheme is exploiting users' trust in the Windows operating system. Fraudsters have set up at least 11 phishing websites hosted on a single server, using names such as "SysScan" to pose as device security assessment tools.
When users visit, these websites display a series of critical yet completely fabricated error warnings. Even more dangerously, they spread false information claiming that the Windows operating system no longer supports third-party antivirus software, thereby urging victims to uninstall these protection applications immediately. In reality, Microsoft has always permitted and supported independent antivirus software to function normally.
Tactics of fabricating system scan results
To make the scam scenario convincing, these websites automatically collect basic information easily obtained through the victim's web browser, such as the operating system in use, screen resolution, memory capacity, or network details. This creates the impression that the system is genuinely performing a deep scan of the device.
However, these websites inherently lack any ability to inspect malware, core software installations, or Windows patches. Instead, they automatically generate pre-programmed threats, such as alleging that memory is under attack or that the computer's protection layer has been disabled. Even the number of reported missing security patches is randomly generated by the system. The device's security score is consistently forced down to an extremely low level (ranging from 13 to 30 on a 100-point scale) to induce severe panic in viewers.
Ultimate goal: Hijacking information and remote control
The true objective of this entire charade is to panic victims into willingly removing the sole line of defense on their machines. Immediately after the "fake scan" process finishes, a refund request form appears, requiring users to fill in extensive sensitive information.
This form not only collects names, addresses, phone numbers, and emails, but also requests bank names, requested refund amounts, and cryptocurrency account handles. Most alarmingly, the perpetrators demand that victims provide IDs and passwords for about 30 different remote control software applications. Researchers suspect that this form is often filled out by the scammers themselves while guiding the victim over the phone and directly taking control of their computer. This entire lucrative volume of data is then funneled to hackers, paving the way for unpredictable financial and privacy consequences.
In short, in the face of increasingly sophisticated scam tactics, general users must remain extremely vigilant when encountering error notifications that suddenly appear on their web browsers. Remember that no website can deeply scan your computer system with just a few clicks, and under no circumstances should you provide passwords or remote access permissions to anyone you do not know.
Refer to: Cyber Press
