Scammers are running Microsoft-branded “SysScan” websites that display a fake security scan and falsely claim Windows no longer supports third‑party antivirus. Victims are pressured to uninstall their antivirus, submit personal and banking details, and prepare for a “refund manager” phone call, often involving remote-access tools so the scammer can take control of the computer.
The scam begins with Microsoft-branded websites calling themselves SysScan. These sites display a fake security scan that always reports serious problems, regardless of the actual state of the machine. The scan falsely claims that Windows no longer supports third-party antivirus and instructs the visitor to uninstall their security software immediately. Once the antivirus is gone, the victim is guided into a form that collects a name, address, phone numbers, email, refund amount and reason, bank name, cryptocurrency username, antivirus product, and even the ID and password for a remote-access session. The victim is then held on a waiting page and told a refund manager will call within three to five minutes, handing the interaction off to a live phone scam.
By the time anyone starts asking about bank details, the victim has already seen a Microsoft-branded scan, been told their computer has serious problems, removed their antivirus, and entered information into what looks like an official refund process. Each step builds on the last, so the request for sensitive data feels like a natural continuation rather than a sudden red flag. The submitted information is also sent to Telegram via the bot API, which makes the scam infrastructure cheap to run and easy to replace if a site is taken down.
A web page can only see limited information from a browser. It cannot inspect firmware settings, antivirus status, memory vulnerabilities, or exact patch levels, so any site claiming to have run a deep scan should be closed immediately. Antivirus software should never be uninstalled because a website says so; instead, verify with IT or the vendor through contact methods you already trust. Legitimate refunds never require installing remote-access software or handing over control of a computer. If banking details were already shared, contact the bank directly using a phone number looked up independently rather than one supplied during the interaction. Employees across all roles, including finance and executive staff, should be aware that this pattern can move quickly from a fake scan to a live phone call designed to extract money or account access.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is a set of Microsoft-branded websites calling themselves SysScan that run a fake scan and always claim serious problems, telling victims their antivirus is the cause and instructing them to uninstall it.
The uninstall step removes a layer of protection and sets up a false narrative that a refund is owed, moving the victim toward a form that collects personal, banking, and remote-access details.
Victims submit a form with contact, banking or crypto, and remote-access session details, then wait on a page telling them a refund manager will call within three to five minutes.
Contact your bank immediately using a phone number you look up yourself rather than one given during the scam interaction.
Imagine this: a Microsoft-looking site called "SysScan" pops up, runs a fake Windows scan, and says your antivirus is the problem. The page insists: "Windows no longer supports third-party antivirus. Uninstall it immediately." Then it asks for your name, bank details, even remote-access ID and password, promising a refund and a "refund manager" call in three to five minutes. Here’s the catch: a website cannot run a real deep security scan. If a page claims it scanned your PC and demands you remove antivirus or share banking or remote-access details, it’s a scam, no matter how official it looks. If any website tells you to uninstall antivirus or give remote-access or banking details for a refund, close the page immediately and call IT using our normal channels.
Okta says it gained an inside look at “Work Panel,” a polished SaaS-style dashboard that helps voice-phishing (vishing) crews rapidly set up fake login sites and guide victims through password and MFA capture. The tool clones brand look-and-feel for services like Okta and Microsoft 365, then lets a…
This weekly roundup describes multiple real-world campaigns where attackers trick people using familiar brands and “verification” prompts to steal credentials or install remote-control tools. The common theme is trust abuse: messages and web pages look legitimate, then push users to log in, click…
The roundup describes multiple real-world attacks where criminals manipulate people, not just systems, such as fake bank support calls that trick victims into installing phone malware, and “ClickFix” lures that convince Mac users to run malicious commands. It also highlights an AI-assisted…
This threat trend report describes multiple real-world APT campaigns where attackers rely on social engineering and trusted services (Zoom/Teams, Telegram, webmail, GitHub) to steal credentials and access cloud accounts. Notable examples include fake meeting lures to deliver malware, and abuse of…
Cofense reports ongoing mass email campaigns that impersonate trusted brands (and even government agencies) to trick recipients into calling a phone number for “remediation.” The lures typically claim an unauthorized purchase or a password reset and use urgency to pressure victims into acting…
This recap describes multiple real-world social-engineering-driven attacks, including vishing calls that push employees to spoofed login pages and a supply-chain trick where cloning/opening a GitHub repo in developer tools triggers malware. It also highlights an unusual case where an AI model…
