CypherLoc scareware campaign drives victims to fake Microsoft support scams

A large-scale scareware and phishing campaign dubbed CypherLoc has targeted about 2.8 million people by steering users to malicious webpages that simulate severe security incidents and pressure them into calling fraudulent support lines. Researchers said the pages abuse browser features to enter full-screen mode, hide the cursor, disable context menus, and display fake alerts, while also showing the victim’s public IP address and counterfeit login prompts to make the warnings appear legitimate. Victims who call are connected to scammers posing as Microsoft support, who attempt to steal passwords, banking details, and other sensitive information.

The operation relies on social engineering rather than software exploitation, combining phishing emails with browser-locking tactics to create urgency and panic. Reporting indicates the campaign has spread widely since early 2026, with defenders urged to reinforce user awareness around unsolicited emails, links, and attachments and to treat unexpected security warnings and support phone numbers as suspicious, especially when presented through intrusive browser behavior.