Scammers Abuse Microsoft Azure for Fake Windows Security Alerts
Cybercriminals are leveraging Microsoft Azure to host deceptive websites displaying fake Windows security alerts, tricking users into calling fraudulent support numbers.
Scammers are actively exploiting Microsoft Azure's cloud infrastructure to host convincing fake Windows security alerts, a tactic that has exposed users across 80 organizations between March and October 2026. The operation, which remained active with new landing pages appearing daily as of early November 2026, aims to lure unsuspecting individuals into contacting fraudulent technical support.
The attack chain typically begins with a malicious advertisement displayed on a legitimate website. Clicking this advertisement redirects the user to an Azure-hosted page designed to mimic critical system warnings, such as "System Error" or "Windows Firewall" alerts. These pages are carefully crafted to instill a sense of urgency, pushing users towards a prominently displayed toll-free support number.
Researchers from PIXM identified the scam kit and its supporting infrastructure, noting that this is a browser-based scam rather than a direct malware infection. The deceptive pages employ JavaScript to dynamically assign support numbers via a central service using JSONP, a technique that allows for the loading of responses through script tags. This method enables the scammers to easily rotate support numbers across deployed pages without needing to rebuild each site individually. A tracking pixel is also integrated to monitor campaign effectiveness by recording displayed numbers, campaign details, publisher websites, and advertising exchanges, helping operators attribute incoming calls to specific advertising efforts.
Analysis of the scam kit revealed clues suggesting Mandarin-speaking developers and connections to mainland China. Script comments and error messages were found in Simplified Chinese, and one page family displayed a copied Chinese full-screen notice. The telephone service also exposed a default BaoTa server-panel page in Chinese, and registration records indicated a Hubei address, although PIXM stressed that self-reported information cannot definitively establish attribution.
The advertisements used in this campaign were distributed through programmatic exchanges, leading to placements on various legitimate websites including Whitepages, Legacy.com, Us Weekly, MSN, KMBC, WordHippo, Juno webmail, and the health section of US News & World Report. PIXM clarified that these publishers were not complicit in the scam, as the malicious advertisements were likely served through ad networks.
The immediate danger lies in the interaction following the fake security alert. Scammers commonly use these calls to persuade victims to install remote-access software, charge for non-existent repairs, or engage in refund and bank-impersonation schemes. While this specific campaign does not appear to involve direct malware deployment, the tactic of impersonating support and gaining remote access is a common thread in many cyber threats.
Defenders are advised to block the identified malicious infrastructure through DNS controls or secure web gateways and to restrict the use of remote-access software to approved support workflows. Employees encountering such alerts should be trained to close suspicious tabs or force-quit their browsers rather than calling the displayed numbers. While blocking the telephone service can disrupt dynamic number delivery, the fallback number mechanism means this should not be considered a complete solution.