Fake Windows Defender Alerts weaponized to target users

A tech support scam is an extensive fraud where the scammer offers a support service for any legitimate entity and lures the victim into contacting the scammer via a fake support helpline number. After contacting the helpline, the scammer gains access to the victim’s machine and can perform activities such as fraudulent transactions, stealing sensitive data, etc.

Recently, Cyble Research & Intelligence Labs (CRIL) identified a new ongoing tech support scam where the Threat Actor has developed various phishing websites that pretend to be Microsoft support sites that show a fake Windows defender alert.

We have observed over 50 phishing sites related to this scam since September 2022, and the related IP 68.178.145[.]199 is located in India. In the past, a study related to the scam found that 85% of IPs involved in tech support scams were located in India.

We believe the user may have received this phishing URL via email or SMS, similar to other tech support scams. When users visit this phishing site hxxp://7878winsupportonline[.]xyz, it opens various popups warning them that their computer has been locked and alerts users by playing an audio “important security message” until the user closes the fake website.

After opening the phishing site, it displays the “Quick Scan” pop-up and a fake scan stating that it has detected threats on the victim’s machine, as shown in the image below

The phishing site also shows the fake Threat Scan result with the detection name, type of malware, object type, and location. The TA shows these fake results to victims to make them believe their machine has been compromised by multiple threats.

Further, the phishing site displays a pop-up window that states that the victim’s computer has been blocked due to illegal activity. Additionally, the site notifies victims that their computers have been infected with the Trojan spyware and sensitive data such as email credentials, banking passwords, Facebook login, pictures & documents have been compromised.

To unlock the device and prevent identity theft, the phishing site advise the user to call a support technician and shows a “Windows Defender Security Center” pop-up that contains a support contact number, as shown below.

Additionally, CRIL observed the tech support scam targeting iPhone devices as well. The phishing site hxxp://0044winsupportonline[.]xyz pretends to be an official Apple support website and shows the message that the device has been locked due to illegal activity. To unlock the device, the victim needs to contact the customer support number mentioned on the phishing site.

After contacting the scammers, they gain access to the victim’s system using any third-party remote desktop application. They can then perform several activities, including performing fraudulent transactions and installing other malware such as RATs, stealers, or other unwanted programs that can steal sensitive data from the victim’s machine.

 Conclusion

Scammers are constantly developing new strategies and different campaigns to target potential victims. Our research indicates that scammers involved in tech support scams leverage the legitimacy of reputable firms such as Microsoft to lure their victims into calling what they believe is a customer support helpline. The scammers can then further steal sensitive data from the victim’s machine.

Typically, Windows Defender will only alert users via the installed Windows Defender application and not via a web browser.

Cyble Research & Intelligence Labs constantly monitors active phishing campaigns and keeps our readers updated with our latest findings about phishing and other types of data-stealing attacks.

Our Recommendations

We have listed some essential cybersecurity best practices that create the first line of control against attackers. We recommend that our readers follow the best practices given below:

• Turn on the automatic software update feature on your computer, mobile, and other connected devices wherever possible and pragmatic. 
• Regularly monitor your financial transactions, and if you notice any suspicious activity, contact your bank immediately. 
• Use a reputed anti-virus and Internet security software package on your connected devices, including PC, laptop, and mobile. 
• Refrain from opening untrusted links and email attachments without verifying their authenticity. 

Indicators Of Compromise (IOCs)