Scammers have been leveraging Microsoft’s Azure platform to host counterfeit Windows security alerts, which urge users to contact fraudulent support numbers. This deceitful tactic has targeted users in 80 different organizations between March and October 2026. As of November 2, new fraudulent landing pages continue to emerge, highlighting the ongoing nature of this scheme.
Widespread Exposure to Fake Alerts
The incidents reported describe exposure to these scam pages rather than confirmed breaches across the networks. The attack typically initiates when a user clicks on an advertisement on a legitimate website, redirecting them to an Azure-hosted page. Here, users encounter alarming security messages and a fake support chat designed to deceive.
Similar scams have utilized Bing advertisements to reach unsuspecting business users, exemplifying how paid advertisements can transform routine browsing into a risky encounter. Researchers from PIXM have identified the scam kit and outlined part of its supporting infrastructure in their November 2 investigation.
Technical Aspects of the Scam
This scam involves a browser-based support ruse rather than a direct malware infection. The Azure pages mimic “System Error” and “Windows Firewall” warnings, with all elements directing users to call a toll-free number. The setup employs JavaScript to request a telephone number from a central service using JSONP, a technique that loads responses through scripts.
An advertising-manager parameter determines which operator’s number to return, allowing operators to change numbers without rebuilding each site. Additionally, a tracking pixel records details such as the displayed number, campaign, publisher website, and advertising exchange, assisting operators in linking calls to specific campaigns.
Broader Implications and Defense Strategies
There are indications that the scam’s developers may be Mandarin speakers, with script comments and error messages written in Simplified Chinese. One page family even displayed a Chinese full-screen notice. The telephone service also revealed a default server-panel page in Chinese, and registration records pointed to a Hubei address, although PIXM cautions against relying solely on self-reported information for attribution.
Scammers often exploit these warnings to persuade victims to install remote-access software, incur charges for unnecessary repairs, or engage in refund and bank-impersonation schemes. To counter these threats, organizations should block the identified malicious infrastructure using DNS controls or secure web gateways and restrict remote-access software to approved support workflows. Employees should be advised to close suspicious tabs or force-quit the browser instead of calling numbers displayed on scam pages.
Ultimately, trusted cloud hosting does not make a rendered warning trustworthy. Organizations must remain vigilant and adopt robust cybersecurity measures to protect themselves from these evolving threats.
