Azure-Hosted Fake Microsoft Support Kit Reaches Users at 80 Organizations

Scammers used Microsoft Azure to host fake Windows security alerts that pushed visitors to fraudulent support numbers, exposing users at 80 organizations between March and October 2026, according to PIXM. New landing pages were still appearing on November 2. Paid advertisements directed users to disposable Azure Static Websites displaying fake “System Error,” “Windows Firewall,” and Microsoft Support messages. The kit dynamically retrieved telephone numbers and tracked advertising attribution, suggesting a deceptive pay-per-call operation. The observed reach represents exposure, not confirmed breaches.

PIXM traced a Cloudflare-protected supporting back end associated with exposure at 11 organizations; other operators used the same fake pages. Chinese-language code artifacts and infrastructure records suggested Mandarin-speaking developers and possible connections to Hubei, China, but did not establish attribution. Separately, Netskope reported malicious Bing ads leading users at 48 U.S. organizations to Azure Blob Storage support scams in February, illustrating similar abuse of advertising and trusted cloud hosting without establishing a shared operator. Defenders should block identified malicious infrastructure, restrict remote-access software to approved support workflows, and train users to close suspicious browser pages rather than call displayed numbers.