Scammers abuse Microsoft Azure to host fake Windows alerts
Original title: Scammers Use Microsoft Azure to Host Fake Windows Security Alerts Seen at 80 Organizations
Fake security warnings at 80 organizations direct users to toll-free scam calls via dynamic Azure pages.
Scammers host fake Microsoft support pages on Azure that display alarming warnings imitating System Error and Windows Firewall alerts. Clicking leads to a JavaScript-driven service returning operator phone numbers for fraudulent calls. The campaign used ad placements on legitimate sites and remained active with daily new pages as of November 2.
Unconfirmed: Specific backend attribution covers 11 organizations; other operations may use similar pages
- Fake kit reached 80 organizations March-October 2026
- New landing pages appeared daily as of November 2
- Dynamic phone numbers delivered via JSONP API
- Tracking pixel records campaign and publisher data
- Simplified Chinese comments suggest Mandarin developers
Impact: Social engineering leading to fraudulent calls or malware installation
- 1.Block adhelper[.]cc and related Azure domains via DNS
- 2.Use secure web gateways to filter malicious landing pages
- 3.Restrict remote-access tools to approved support workflows
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | adhelper.cc | rs of compromise (IoCs):- Indicator Type Reported role call.adhelper[.]cc Hostname Telephone API: /api/get-phone.php adhelper[.]cc |
| domain | adhelper.one | frastructure aff.adhelper[.]cc Hostname Affiliate subdomain adhelper[.]one Domain Impression tracker; registrar hold since October 2 |
| domain | czlbb.site | -acd1-e3b9b76addea Account ID Adhelper tracking account img.czlbb[.]site Hostname Second impression tracker 38c0f7e2-0e29-48e2-b09 |
| domain | windows.net | ed on April 3, 2026. The bar at top center reads “…web.core.windows[.]net – 若要退出全屏模式，请按 esc”, Chrome’s “To exit full screen, press |
From the original article
3 min read at cybersecuritynews.com
Scammers are abusing Microsoft Azure to host fake Windows security alerts that pressure users into calling fraudulent support numbers. Between March and October 2026, the same fake Microsoft support kit reached users at 80 organizations. New landing pages were still appearing daily as of November 2, showing that the operation remained active.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.