Fake Microsoft Support Scams Spread Through Online Ads
Original title: Fake Microsoft Support Scams Spread Through Online Ads as Researchers Uncover Organized Fraud Network
Researchers link backend to Hubei, China developers; scam kit detected at 80 organizations.
An organized fraud network used paid ads and Azure hosting to distribute fake Microsoft support pages. The scam pages push toll-free numbers for remote access or financial fraud. The backend shows centralized management by Mandarin-speaking operators.
- Kit reached 80 organizations with fresh pages daily
- Phone number rotation via call.adhelper.cc
- Registration in Hubei province, China
- Ad placements on major sites like Whitepages
Impact: victims tricked into providing remote access or paying for fake repairs
- 1.Review published indicators of compromise
- 2.Block malicious infrastructure
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | adhelper.cc | alization. JavaScript requests a telephone number from call.adhelper[.]cc/api/get-phone.php through JSONP, passing an ads_manager i |
| domain | adhelper.one | 26 (Source : PIXM security). A separate tracking request to adhelper[.]one records the displayed number, campaign, publisher domain, |
| domain | windows.net | a randomly named Azure Static Website under *.z13.web.core.windows[.]net , presenting fake “System Error” alerts, Windows Firewall |
From the original article
3 min read at gbhackers.com
An organized fraud operation using paid advertisements, Microsoft Azure hosting, and centrally managed telephone numbers to distribute counterfeit Microsoft support pages. The investigation links one backend serving the kit to Mandarin-speaking developers and registration details referencing Hubei, China. Those findings suggest operational connections, not definitive attribution.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.