CampaignPublished 21 Oct 2025

Microsoft Branding Used in New Tech Support Scam

Source AlienVault OTX General

Description

A new tech support scam campaign exploits Microsoft's trusted brand to deceive users. It starts with phishing emails promising payments, leading victims to fake CAPTCHA challenges. After completion, users are redirected to a browser-locked landing page mimicking ransomware, with multiple pop-ups resembling Microsoft security alerts. These pop-ups urge victims to call a fraudulent support number, enabling phone-based social engineering. The scam combines browser manipulation, phishing, and social engineering to potentially gain system access. No direct malware or exploits are involved, but the psychological manipulation can lead to financial loss or unauthorized access. The campaign underscores the risks of trusting familiar branding without verification and highlights the need for user awareness and layered defenses. Indicators include multiple malicious URLs and domains used in the campaign. The threat is medium severity due to its social engineering nature and potential impact on confidentiality and integrity.

Impact

For European organizations, this scam poses a significant risk primarily through social engineering and potential financial fraud. Employees may be tricked into divulging credentials, installing remote access tools, or making payments to fraudulent entities, leading to unauthorized access or financial losses. The psychological impact can cause operational disruption if users believe their systems are compromised. While the campaign does not directly deploy malware, the resulting unauthorized access can lead to data breaches, loss of confidentiality, and potential lateral movement within networks. The use of Microsoft branding increases the likelihood of success given Microsoft's widespread use in Europe. Organizations may face reputational damage if employees fall victim, and regulatory consequences under GDPR if personal data is compromised. The threat also stresses the importance of user training and awareness as technical controls alone may not prevent such scams.

Defensive guidance

1. Implement advanced email filtering to detect and quarantine phishing emails, focusing on payment lure keywords and suspicious URLs. 2. Deploy browser security solutions that can detect and block malicious scripts and pop-ups, especially those attempting to lock browsers or mimic system alerts. 3. Conduct targeted user awareness training emphasizing skepticism of unsolicited payment offers, fake CAPTCHA challenges, and unsolicited tech support calls. 4. Establish clear organizational policies that prohibit employees from calling unsolicited support numbers or providing credentials over the phone. 5. Use multi-factor authentication (MFA) to reduce the risk of credential compromise. 6. Monitor network traffic for connections to known malicious domains and URLs listed in the indicators, and block them at the perimeter. 7. Encourage reporting of suspicious emails or browser behavior to security teams for rapid response. 8. Regularly update and patch browsers and security software to mitigate exploitation of browser vulnerabilities that could facilitate such scams. 9. Consider deploying endpoint detection and response (EDR) tools that can identify unusual user behavior indicative of social engineering exploitation. 10. Collaborate with threat intelligence providers to stay updated on emerging scam campaigns and indicators.

Summary

This campaign leverages Microsoft's brand recognition to conduct a sophisticated tech support scam targeting users primarily through email phishing. The attack begins with an email that entices the recipient with a promise of payment, prompting them to interact with a fake CAPTCHA challenge designed to appear legitimate. Upon completing this challenge, victims are redirected to a malicious landing page where their browser is manipulated to appear locked, simulating a ransomware attack scenario. The page generates multiple pop-ups that mimic official Microsoft security alerts, creating a sense of urgency and fear. These alerts instruct users to call a fake support number, where social engineers attempt to extract sensitive information, gain remote access, or solicit payments. The campaign employs multiple tactics including browser manipulation (T1185), phishing (T1566.002, T1566.003), user execution (T1204.001, T1204.002), input capture (T1056.002), and masquerading as trusted software (Microsoft branding). While no direct malware or exploits are reported, the psychological manipulation and social engineering techniques can lead to significant compromise. The campaign's indicators include numerous malicious URLs and domains that host the fake CAPTCHA and landing pages. This threat highlights the importance of skepticism towards unsolicited communications, especially those leveraging trusted brands, and the need for multi-layered security controls to detect and block such social engineering attempts.

Indicators of compromise

Domains 8

alphadogprinting.com
amormc.com
blutrecheshetrubler.highbourg.my.id
chubagledivepreli.highbourg.my.id
deprivy.stified.sbs
dukublavuprotutuv.highbourg.my.id
nasubutrachat.highbourg.my.id
shilebatablurap.highbourg.my.id

URLs 10

http://amormc.com/index.php?3xmvgr
http://amormc.com/index.php?ndv5f1
http://chubagledivepreli.highbourg.my.id/win/index.php
http://deprivy.stified.sbs/proc.php
https://alphadogprinting.com/index.php?8jl9lz
https://blutrecheshetrubler.highbourg.my.id/win/index.php
https://dukublavuprotutuv.highbourg.my.id/win/index.php
https://my.toruftuiov.com/9397b37a-50c4-48c0-899d-f5e87a24088d
https://nasubutrachat.highbourg.my.id/win/index.php
https://shilebatablurap.highbourg.my.id/win/index.php

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 21 Oct 2025, 16:20 UTC

MITRE ATT&CK techniques10 from threat tags

Technical details

Indicators of compromise

Domains 8

URLs 10

Community reviews

Related threats