Loading story…
A large-scale scareware and phishing campaign dubbed CypherLoc has targeted about 2.8 million people by steering users to malicious webpages that simulate severe security incidents and pressure them into calling fraudulent support lines. Researchers said the pages abuse browser features to enter full-screen mode, hide the cursor, disable context menus, and display fake alerts, while also showing the victim’s public IP address and counterfeit login prompts to make the warnings appear legitimate. Victims who call are connected to scammers posing as Microsoft support, who attempt to steal passwords, banking details, and other sensitive information.
The operation relies on social engineering rather than software exploitation, combining phishing emails with browser-locking tactics to create urgency and panic. Reporting indicates the campaign has spread widely since early 2026, with defenders urged to reinforce user awareness around unsolicited emails, links, and attachments and to treat unexpected security warnings and support phone numbers as suspicious, especially when presented through intrusive browser behavior.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
A large-scale scareware and phishing campaign dubbed CypherLoc was reported as having spread widely since early 2026, targeting about 2.8 million people through phishing emails and browser-locking social engineering rather than software exploits. Victims were lured to malicious pages showing fake security alerts, public IP information, and fraudulent Microsoft support numbers to steal passwords and banking details.
TechRadar summarized CYFIRMA's findings, describing Operation SilentCanvas as a professionally engineered campaign targeting enterprises and organizations that use remote administration tools. The coverage highlighted its use of trojanized ScreenConnect, credential theft, screen and microphone capture, clipboard monitoring, and recommendations for detection and containment.
CYFIRMA reported a multi-stage intrusion campaign using a weaponized JPEG file named sysupdate.jpeg to launch obfuscated PowerShell, deploy a trojanized ConnectWise ScreenConnect instance, and establish persistence via a fake OneDriveServers Windows service. The report detailed AMSI bypass, UAC bypass, encrypted command-and-control, and capabilities including credential theft, surveillance, and potential ransomware enablement.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
5 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcetechradar.com
Open sourcecyfirma.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybercriminals are increasingly leveraging sophisticated social engineering tactics that exploit users' trust in Microsoft branding and their tendency to follow technical instructions. Microsoft has reported a significant rise in ClickFix attacks, a method where attackers trick users into executing malicious code by presenting fake error messages or technical problems that appear to require immediate user intervention. These attacks are designed to bypass traditional phishing protections, as they rely on manipulating human behavior rather than exploiting technical vulnerabilities. According to Microsoft’s latest Digital Defense Report, ClickFix was observed as the initial access method in 47% of attacks, highlighting its widespread adoption among threat actors. The report also notes a broader trend of AI abuse, extortion, and ransomware, but emphasizes the unique danger posed by ClickFix due to its adaptability and reliance on social engineering. In parallel, security researchers at Cofense have identified a new tech support scam that uses Microsoft’s logo and branding to create a convincing illusion of a browser lock, further manipulating victims into believing their systems are compromised. This scam typically begins with a phishing email offering a fake refund, luring users to click a link that leads to a CAPTCHA challenge, which both increases the attack’s credibility and helps evade automated security tools. Once the victim completes the CAPTCHA, they are confronted with pop-ups mimicking genuine Microsoft security alerts, and their browser is manipulated to appear locked, even disabling mouse control to heighten the sense of urgency and panic. The attackers then prompt the victim to call a fake support number, where further social engineering is used to steal sensitive information or gain deeper access to the victim’s system. Both attack types demonstrate a shift in cybercriminal tactics toward exploiting human psychology and trusted brands, rather than relying solely on technical exploits. Microsoft’s data-driven insights underscore the scale of the problem, with the company processing over 100 trillion signals daily and blocking millions of malware and phishing attempts. The sophistication of these attacks makes user awareness and behavioral change critical, as traditional security tools may not detect or prevent such threats. Organizations are urged to educate users about these evolving tactics, emphasizing the risks of following unsolicited technical instructions or responding to suspicious support requests. The convergence of ClickFix and tech support scams signals a broader trend in cybercrime, where attackers blend technical manipulation with psychological pressure to achieve their objectives. As these methods continue to evolve, both individuals and enterprises must remain vigilant and adapt their defenses accordingly. The use of Microsoft branding in these scams amplifies their effectiveness, making it essential for users to verify the legitimacy of any technical prompts or support communications. Security teams should update training materials and incident response protocols to address these emerging threats, ensuring rapid detection and mitigation. The ongoing rise of such social engineering attacks highlights the need for a multi-layered security approach that combines technical controls with robust user education.
Jun 29, 2026
Researchers uncovered a refund scam campaign using Microsoft-branded **"SysScan"** websites that pretend to test whether a victim’s antivirus is working, then display fabricated security findings to claim third-party protection is causing serious problems or is no longer supported by Windows. The pages do not perform real diagnostics; instead, they rely on basic browser-visible system details plus hardcoded or randomized results to ensure alarming outcomes and pressure users to uninstall their antivirus software. After the fake scan, the sites collect extensive personal, banking, antivirus, and remote-access information through forms apparently built to support live scam operators during follow-up calls, including fields for agent identifiers and selected security products. Researchers identified **11** such sites on a single host and found that submitted data is sent directly to **Telegram** via the bot API, after which victims are placed on a waiting page promising a callback from a refund manager; parts of the site code and media also showed signs of being AI-generated or adapted from a broader scam template.
Aug 25, 2026
Security researchers reported several **social-engineering campaigns** that abuse trusted platforms to increase credibility and bypass controls. One campaign targeted wedding planners and related vendors by hijacking trust in *Microsoft Teams*: attackers used compromised legitimate email threads and impersonated legal professionals (e.g., `czimmerman@craigzlaw[.]com`) to lure victims into clicking a fake Teams meeting link that ultimately redirected to `ussh[.]life/connect/teamsfinal/9/windows`, a site masquerading as a Teams download page. Victims were prompted to download Windows executables consistent with **information-stealer** behavior (credential/browser/session-token theft and C2 exfiltration), enabling follow-on account takeover and additional phishing. Separately, a report highlighted **DKIM replay**-style phishing in which criminals abuse legitimate notification/invoice workflows from **PayPal, Apple, and DocuSign** to generate cryptographically signed emails that pass DKIM/DMARC checks; attackers place scam content (often a fake support phone number and urgency) into user-controlled fields, send the message to themselves to obtain a “clean” vendor-signed email, then forward it to targets. Another campaign used **Bing search ads** to funnel users through a newly registered domain (`highswit[.]space`) to scam pages hosted on **Microsoft Azure Blob Storage** (consistent path pattern including `werrx01USAHTML/index.html` and a phone-number parameter), presenting fake Microsoft security warnings and directing victims to call numbers such as `1-866-520-2041` and `1-833-445-4045`; Netskope observed impact across dozens of US organizations.
Jun 29, 2026