Fake Microsoft Alerts Push Remote-Access Scams

Researchers linked a long-running traffic distribution system (Help TDS) to the Hotejka affiliate program that redirects people from compromised websites to fake Microsoft Windows security alerts. The pop-ups try to trap users in the browser and pressure them to call a “Windows Support” number, where scammers convince victims to install remote desktop tools so attackers can take control of the device.

Key findings

• Help TDS routes visitors from compromised sites to tech support scam pages that imitate Microsoft Windows security alerts and attempt to prevent the user from exiting the browser.
• Victims are instructed to call a “Windows Support” number; call centers then use social engineering to get the victim to install remote desktop software (e.g., Ultraviewer).
• Since April 2026, the scam landing pages have been hosted at scale on free Cloudflare Pages subdomains (*.pages[.]dev), with “over 20,000 such domains” detected.
• Affiliates include multiple web compromise / redirect operations (e.g., Balada Injector, Detour Dog, DollyWay) that send traffic into the TDS using specially crafted URLs.
• The ecosystem includes compromised WordPress sites and malicious plugins used to enable redirection and, in some cases, credential theft.

Who’s being targeted

• Commonly targeted roles: All employees, IT Helpdesk / Service Desk, Security awareness training audiences, Web/Marketing teams that manage WordPress sites.
• Affected industries: General public / consumers, Any organization with employees browsing the web, Website owners (especially WordPress site operators).
• Attack channels: website, vishing.
• Impersonated: Microsoft / Windows Technical Support, Microsoft / Windows Support.

Awareness takeaways

• Treat unexpected ‘Windows/Microsoft security alerts’ in a browser as suspicious, especially if the page tries to trap you or urges you to call a number.
• Never install remote desktop/remote support tools at the request of an unsolicited pop-up or unknown caller; use your company’s official IT process instead.
• Website redirects and pop-ups can come from otherwise legitimate sites that have been compromised; report suspicious browser behavior to IT/Security.
• Be aware scammers may use disposable hosting (including legitimate platforms) to scale these scams rapidly, so a ‘normal-looking’ domain isn’t proof of legitimacy.

Red flags to watch for

• High-pressure warnings telling you not to restart and claiming Microsoft has locked your computer
• Full-screen/exit-prevention behavior in the browser
• A support agent asks you to install remote access software to “fix” the issue
• Web page is “very difficult to exit” and behaves like a browser lock
• Unsolicited security alerts presented via a normal website visit
• The page pushes you toward a phone call rather than normal support channels