Loading story…
Researchers uncovered a refund scam campaign using Microsoft-branded "SysScan" websites that pretend to test whether a victim’s antivirus is working, then display fabricated security findings to claim third-party protection is causing serious problems or is no longer supported by Windows. The pages do not perform real diagnostics; instead, they rely on basic browser-visible system details plus hardcoded or randomized results to ensure alarming outcomes and pressure users to uninstall their antivirus software.
After the fake scan, the sites collect extensive personal, banking, antivirus, and remote-access information through forms apparently built to support live scam operators during follow-up calls, including fields for agent identifiers and selected security products. Researchers identified 11 such sites on a single host and found that submitted data is sent directly to Telegram via the bot API, after which victims are placed on a waiting page promising a callback from a refund manager; parts of the site code and media also showed signs of being AI-generated or adapted from a broader scam template.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Researchers determined the browser-based scans cannot perform real endpoint security checks and instead combine limited browser-exposed data with hardcoded or randomized findings to guarantee alarming results. They also noted heavily commented code and labels marking checks as fake or exaggerated, suggesting parts of the scam code may have been AI-generated or AI-assisted.
Analysis showed the scam sites collect personal, banking, antivirus, and remote-access details through an operator-oriented form and send submitted data directly to Telegram’s bot API without requiring a backend server. The sites then redirect victims to a waiting page promising a callback from a refund manager within three to five minutes.
Researchers identified a refund scam campaign using Microsoft-branded fake “SysScan” websites that simulate security scans, pressure victims to uninstall antivirus software, and funnel them into a phone-based fraud workflow. They found eleven related sites on a single host and linked the campaign to IP 157.230.180.90 and multiple SysScan-themed domains.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourcemalware.news
Open sourcemalwarebytes.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A large-scale scareware and phishing campaign dubbed **CypherLoc** has targeted about **2.8 million people** by steering users to malicious webpages that simulate severe security incidents and pressure them into calling fraudulent support lines. Researchers said the pages abuse browser features to enter full-screen mode, hide the cursor, disable context menus, and display fake alerts, while also showing the victim’s public IP address and counterfeit login prompts to make the warnings appear legitimate. Victims who call are connected to scammers posing as **Microsoft support**, who attempt to steal passwords, banking details, and other sensitive information. The operation relies on social engineering rather than software exploitation, combining phishing emails with browser-locking tactics to create urgency and panic. Reporting indicates the campaign has spread widely since early 2026, with defenders urged to reinforce user awareness around unsolicited emails, links, and attachments and to treat unexpected security warnings and support phone numbers as suspicious, especially when presented through intrusive browser behavior.
Jun 29, 2026
Attackers used convincing lookalike websites impersonating **CNN**, **Avast**, and **Stremio**, along with fake crypto-mining game pages, to trick Windows users into installing **O&O Syspectr**, a legitimate, digitally signed remote administration tool. The installers were pre-linked to attacker-controlled Syspectr accounts, giving operators remote command execution, file access, software installation, and broader system control while reducing the chance of antivirus detection because the software itself was genuine. Researchers found the CNN-, Avast-, and Stremio-themed installers shared one embedded Syspectr account ID, while the crypto-themed lure used another, suggesting either multiple operators or separate accounts used by the same group. The activity aligns with a broader phishing trend in which threat actors abuse legitimate remote monitoring and management tools instead of custom malware. In the **SeasonalInvite** campaign, active since at least January, attackers used nearly 1,000 domains, poisoned search results, and fake eCard pages to deliver signed tools including **ConnectWise ScreenConnect**, **LogMeIn Resolve**, **Kaseya**, and **O&O Syspectr** to Windows and macOS users. O&O Software GmbH said it suspended the abusive Syspectr accounts and disabled **Remote Desktop** and **Remote Console** for free Syspectr accounts, while researchers warned that the same traffic distribution infrastructure may be supporting multiple phishing operations.
Aug 11, 2026
Attackers have set up more than 70 lookalike websites impersonating popular Windows utility and customization apps, including **Wintoys**, **PowerToys**, **WinUtil**, **EasyBCD**, **CrystalDiskMark**, **Lively Wallpaper**, and **SignalRGB**, to lure users searching for downloads. The campaign was uncovered after Wintoys developer **Bogdan Pătrăucean** identified a cloned site for his app and traced it to a wider domain cluster linked by the anonymized WHOIS contact `43345@anonymize.com`, with operators reportedly shifting domains to a new registrar after scrutiny. Researchers said the sites use a staged approach: some initially serve legitimate installers to build trust, then later replace them with malicious downloads. Observed payloads include trojanized installers, persistent **ScreenConnect** remote-access software, **RemusStealer**, **AnimateClipper**, and bandwidth-sharing software, while proxy-backed hosting has helped keep parts of the infrastructure online. Some domains have been flagged by **Cloudflare** or added to **Hagezi** blocklists, but many remain active, increasing the risk for users who download Windows apps from search results instead of official developer pages or the Microsoft Store.
Jul 27, 2026