Scammers abuse Microsoft Azure to host fake Windows alerts that push victims to call fraudulent support lines
- Severity
- Medium
- Sources
- 1
What happened
PIXM tracked a browser-based tech support scam kit abusing Azure-hosted landing pages (subdomains under web.core.windows.net), with a JSONP-driven phone number API, fallback number, and impression trackers that map calls to ad campaigns. Exposure is reported at 80 organisations from March to October 2026, but PIXM attributes only 11 to the back end it investigated, and the Chinese-language artefacts are not proof of attribution. Defenders should block the listed IoCs at DNS or the secure web gateway, restrict remote-access tools to approved support workflows, and train staff to close the tab rather than call displayed numbers. Blocking the phone API alone is insufficient because of the fallback number.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Do not call any phone number shown in a browser warning; close the tab or force-quit the browser instead.
- Block the malicious infrastructure listed by PIXM through DNS controls or a secure web gateway.
- Restrict remote-access software to approved support workflows.
- Warn staff that Windows security alerts appearing in a browser are not reliable evidence of a real problem.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Companies