13M Emails Push Japan Users Into Tech Support Scam

How the attack worked

This campaign combined mass email distribution with fake security warning websites and phone-based social engineering. Over a 165 day period, researchers observed more than 13 million emails, with 94% sent to addresses using Japan's .jp top-level domain. The emails used spoofed senders designed to look like the recipient's own address or a legitimate internal service, moving victims from a deceptive email to a fraudulent support call.

Clicking the link in these emails opened a fake site displaying a bogus security warning. That page pushed the victim to call a listed support number. Once on the phone, the attackers posed as technical support staff and often requested remote control of the victim's device. From there, the scheme moved through three stages: lure the user to the fake alert page, gain remote control while impersonating support staff, and then extract money through fraudulent support fees or wire transfers.

Why it succeeded

The lures increasingly mimicked ordinary workplace communications rather than generic security pop-ups. Starting in May 2026, subject lines referenced internal network security audits, confidential performance evaluations and promotion lists, and employee benefit notices like digital gift cards for a company anniversary. This shift toward workplace themed lures reflects an attempt to reach individuals inside companies and organizations, likely aiming for larger payouts than typical consumer targeting.

The combination of spoofed senders, rapidly rotating fake alert sites, and legitimate hosting and remote access services made the scam harder to filter and more convincing once a victim reached the fake warning page.

What to watch for

• Urgent internal-sounding emails about security audits, performance reviews, salary changes, or employee benefits that include a link
• Web pages that show alarming security warnings and push a phone call to an unfamiliar support number
• Sender addresses that appear to match the recipient's own address or a familiar internal service
• Requests during a support call to allow remote control of a device, followed by instructions to log into online banking

Building resistance

Organizations can reduce exposure by tightening sender authentication and building specific habits among employees:

• Enforce SPF, DKIM, and DMARC to catch spoofed and self-spoofed sender patterns
• Train employees to verify HR and IT notices through a known internal channel before clicking links
• Instruct staff to close fake warning screens without calling any listed number and to verify alerts through official support contacts
• Limit and monitor remote access tool usage, since scammers used remote control sessions to guide victims into banking actions that led to substantial financial losses

Because these lures now closely resemble routine workplace notices, awareness training should specifically cover HR and IT themed phishing, not just generic security alert scams.

How did the tech support scam campaign work?

Attackers sent spoofed emails mimicking internal HR or IT notices with links to fake security alert sites, which pressured victims to call a bogus support line where scammers requested remote device access.

Why were Japanese users targeted?

According to the research, 94% of the more than 13 million emails observed over 165 days were sent to addresses using Japan's .jp top-level domain.

What happened after victims called the fake support number?

In confirmed cases, victims were coached to access their online banking accounts while attackers remotely controlled their devices, resulting in substantial financial losses.

How can organizations reduce risk from this type of scam?

Enforcing SPF, DKIM, and DMARC helps detect spoofed senders, and employees should avoid calling numbers shown in unsolicited security warning pop-ups, verifying alerts through official channels instead.