Fake security scans trick victims into uninstalling their antivirus

This campaign involves a network of eleven fraudulent websites hosted on a single server, branded as SysScan and using Microsoft logos to appear legitimate. The sites conduct fake security scans that manipulate browser data to produce low security scores, ensuring victims believe their antivirus is failing. The scam falsely asserts that Windows no longer supports third-party antivirus software, prompting victims to uninstall legitimate protection. Victims are then lured into submitting sensitive personal and financial information, as well as remote-access credentials, via detailed forms that transmit data directly to Telegram. Following form submission, victims receive calls from supposed refund managers who exploit the removed security protections. The operation targets both consumer and enterprise security software users and exhibits indicators of AI-generated code.

Victims may uninstall legitimate antivirus software, exposing their systems to increased risk of malware and other cyber threats. The scam also leads to the theft of personal information, banking details, and remote-access credentials, which can be used for financial fraud and unauthorized access. The removal of security protections facilitates further exploitation by the attackers, including social engineering via phone calls. The campaign undermines user trust in security software and can result in significant financial and privacy harm.

No official patch or fix applies as this is a social engineering campaign rather than a software vulnerability. Users should be educated to recognize fake security scans and avoid uninstalling legitimate antivirus software based on unsolicited warnings. Organizations should warn employees about this scam and advise against providing personal or financial information through suspicious websites or forms. Blocking access to the identified fraudulent domains can help reduce exposure. Monitoring for related phishing or social engineering attempts is recommended.