Scammers Use Microsoft Azure to Host Fake Windows Security Alerts Seen at 80 Organizations

Scammers are abusing Microsoft Azure to host fake Windows security alerts that pressure users into calling fraudulent support numbers.

Between March and October 2026, the same fake Microsoft support kit reached users at 80 organizations. New landing pages were still appearing daily as of November 2, showing that the operation remained active.

These figures describe exposure to scam pages, not 80 confirmed network breaches. The attack begins with an advertisement on a legitimate website.

Clicking it sends the visitor to an Azure-hosted page displaying alarming security messages and a fake support chat.

Similar Azure tech support scams have used Bing advertisements to reach business users, demonstrating how paid placements can turn routine browsing into a dangerous encounter.

Researchers from PIXM identified the scam kit and traced part of its supporting infrastructure in a November 2 investigation.

Scammers Use Microsoft Azure

Their analysis describes a browser-based support scam rather than a confirmed malware infection. The Azure landing pages imitate “System Error” and “Windows Firewall” warnings, with every element directing visitors toward a toll-free number.

Behind the warning screen, JavaScript requests a telephone number from a central service using JSONP, a technique that loads a response through a script.

An advertising-manager parameter tells the service which operator’s number to return. This lets the organizers change numbers across deployed pages without rebuilding each site. The code also includes a fallback number if the request fails.

A tracking pixel records the displayed number, campaign, publisher website, and advertising exchange. These details help operators connect incoming calls to particular advertising campaigns.

The setup resembles legitimate pay-per-call marketing, but the calls originate from deceptive security warnings. The manager list expanded from three names in May to four in July, suggesting multiple participants rather than one person maintaining every page.

The broader technique echoes separate fake Microsoft security alerts campaigns that use disposable cloud-hosted pages to funnel visitors toward scam call centers.

However, PIXM’s attribution has an important limit: the specific back end it investigated accounted for exposure at 11 organizations. Other operations used the same fake page across the wider group of 80 organizations.

Infrastructure Clues, Business Risks, and Defenses

Several clues suggest Mandarin-speaking developers and connections to mainland China. Script comments and error messages used Simplified Chinese, while one page family displayed a copied Chinese full-screen notice.

The telephone service exposed a default BaoTa server-panel page in Chinese. Registration records also listed a Hubei address, although PIXM stressed that self-reported registration information alone cannot establish attribution.

Tracking data identified placements associated with Whitepages, Legacy.com, Us Weekly, MSN, KMBC, WordHippo, Juno webmail, and the health section of US News & World Report.

PIXM said these publishers were not complicit. The advertisements passed through programmatic exchanges, and reviewers did not necessarily see the same destination presented to targeted visitors.

The immediate danger is the conversation that follows the warning. Scammers commonly persuade callers to install remote-access software, charge for unnecessary repairs, or introduce refund and bank-impersonation schemes.

Separate Microsoft Teams impersonation attacks show how legitimate remote-management software can also become an access channel when users accept instructions from an impersonator. That comparison does not establish malware deployment in this campaign.

Defenders should block the listed malicious infrastructure through DNS controls or secure web gateways and restrict remote-access software to approved support workflows. Employees should close suspicious tabs or force-quit the browser rather than call displayed numbers.

Blocking the telephone service disrupts dynamic number delivery, but the fallback means this should not be treated as complete protection. Trusted cloud hosting does not make a rendered warning trustworthy.

Indicators of compromise (IoCs):-

Indicator	Type	Reported role
call.adhelper[.]cc	Hostname	Telephone API: /api/get-phone.php
adhelper[.]cc	Domain	Back-end infrastructure
aff.adhelper[.]cc	Hostname	Affiliate subdomain
adhelper[.]one	Domain	Impression tracker; registrar hold since October 22
ce895b1f-f630-4bd5-acd1-e3b9b76addea	Account ID	Adhelper tracking account
img.czlbb[.]site	Hostname	Second impression tracker
38c0f7e2-0e29-48e2-b097-c87ec2e542d7	Account ID	Second tracking account
6808f1a5753e2219109a9cc4	Chat property	tawk.to live-chat property
message{MMDD}js{NNN}*.z13.web.core.windows[.]net	Hostname pattern	Active landing pages
viruswarning{MMDD}us*.z13.web.core.windows[.]net	Hostname pattern	March–September landing pages

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.