Known malicious kitcriticalother

Tech-support scam: fake security alert that locks the browser and asks you to call 'support'

family: tech-support-browser-locker-2026-10

Pages that show a fake Microsoft, Windows Defender or Apple security alert (a blocked or infected computer, an error code, a warning sound), switch the browser to full screen, capture the keyboard and block leaving the page so the visitor cannot close it, and tell the visitor to call a 'support' phone number. The call is the scam: the caller is talked into paying for fake repairs or into installing remote-access software. One campaign places the alert on random subdomains of Azure Storage static websites (*.web.core.windows.net) and passes the phone number in the address (?phone=...), in English ('WIndows Err') and Japanese ('読み込みエラー') versions; its lure addresses are matched even after a site has been taken down. No genuine security warning locks the browser or asks you to phone a number.

Anchors

YARA ruleTechSupportScam_BrowserLocker
SMQL queryrun
domain:*.web.core.windows.net AND url:*phone=*

Provenance

Added: 2026-10-17 11:53
Page rule keyed on the locking technique (a full-screen request, keyboard lock or pointer lock) together with fake Microsoft, Windows or Apple support wording and a call-in prompt in the same page or script, not on any host or phone number. The address anchor covers the Azure static-website campaign.

Sightings (48)Atom feed

HostScanScriptMatchScanned
rubarodav.z1.web.core.windows.net1c29cbbb…—query2026-10-16 17:52
rubarodav.z1.web.core.windows.net0700a01f…—query2026-10-16 17:52
gasevinul.z1.web.core.windows.netcfbd6b29…—query2026-10-16 17:51
gasevinul.z1.web.core.windows.net9aa56fb6…—query2026-10-16 17:51
gasevinul.z1.web.core.windows.net4640a659…—query2026-10-16 17:51
pewaweyet.z1.web.core.windows.net355e38e6…—query2026-10-16 12:50
pewaweyet.z1.web.core.windows.netfa3bf7f1…—query2026-10-16 12:50
cewegebit.z31.web.core.windows.net9838c0f0…—query2026-10-16 12:50
cewegebit.z31.web.core.windows.netfbd0f9f4…—query2026-10-16 12:50
vagesomay.z21.web.core.windows.net8016ba9d…—query2026-10-11 05:27
dusayotu.z5.web.core.windows.net7118ab3a…https://dusayotu.z5.web.core.windows.net/eey0kr/#htmlyara2026-10-10 03:22
rubarodav.z1.web.core.windows.netd7548456…https://rubarodav.z1.web.core.windows.net/gx/index.html?phone=%2B1-844-959-2863#htmlyara2026-10-09 16:52
rubarodav.z1.web.core.windows.netd7548456…—query2026-10-09 16:52
rubarodav.z1.web.core.windows.netf672d172…https://rubarodav.z1.web.core.windows.net/gx/index.html#htmlyara2026-10-09 16:52
rubarodav.z1.web.core.windows.net75a640cc…https://rubarodav.z1.web.core.windows.net/?phone=%2B1-844-959-2863#htmlyara2026-10-09 16:52
rubarodav.z1.web.core.windows.net75a640cc…—query2026-10-09 16:52
rubarodav.z1.web.core.windows.net243c44fa…https://rubarodav.z1.web.core.windows.net/?phone=#htmlyara2026-10-09 16:51
rubarodav.z1.web.core.windows.net243c44fa…—query2026-10-09 16:51
rubarodav.z1.web.core.windows.net12fd8b9f…https://rubarodav.z1.web.core.windows.net/#htmlyara2026-10-09 16:51
gasevinul.z1.web.core.windows.netd2390c24…https://gasevinul.z1.web.core.windows.net/gx/index.html?phone=%2B1-844-959-2863#htmlyara2026-10-09 16:51
gasevinul.z1.web.core.windows.netd2390c24…—query2026-10-09 16:51
gasevinul.z1.web.core.windows.net77d91e1b…https://gasevinul.z1.web.core.windows.net/gx/index.html#htmlyara2026-10-09 16:51
gasevinul.z1.web.core.windows.net66e56919…https://gasevinul.z1.web.core.windows.net/?phone=%2B1-844-959-2863#htmlyara2026-10-09 16:51
gasevinul.z1.web.core.windows.net66e56919…—query2026-10-09 16:51
gasevinul.z1.web.core.windows.net2bacd7f5…https://gasevinul.z1.web.core.windows.net/?phone=#htmlyara2026-10-09 16:51
gasevinul.z1.web.core.windows.net2bacd7f5…—query2026-10-09 16:51
gasevinul.z1.web.core.windows.nete1574654…https://gasevinul.z1.web.core.windows.net/#htmlyara2026-10-09 16:51
pewaweyet.z1.web.core.windows.net924ac189…—query2026-10-09 11:51
pewaweyet.z1.web.core.windows.netf791c2b1…—query2026-10-09 11:51
cewegebit.z31.web.core.windows.nete3d0db94…—query2026-10-09 11:50
cewegebit.z31.web.core.windows.netf43bbf80…—query2026-10-09 11:50
cewegebit.z31.web.core.windows.netfecb2243…—query2026-10-09 11:50
gabogeveba.z1.web.core.windows.netd0561dad…https://gabogeveba.z1.web.core.windows.net/?phone=%2B1-844-959-2863#htmlyara2026-10-07 13:36
gabogeveba.z1.web.core.windows.netd0561dad…—query2026-10-07 13:36
locolacus.z1.web.core.windows.netc9f108fd…https://locolacus.z1.web.core.windows.net/?phone=%2B1-844-959-2863#htmlyara2026-10-06 13:29
locolacus.z1.web.core.windows.netc9f108fd…—query2026-10-06 13:29
fururefif.z1.web.core.windows.net337a43d3…—query2026-10-05 00:55
fuvofepa.z14.web.core.windows.net25e8713f…—query2026-10-02 05:45
spiderman-one-delta.vercel.appbc116b7f…https://spiderman-one-delta.vercel.app/assets/Home-PduBlHy5.jsyara2026-10-01 14:45
spiderman-one-delta.vercel.app60cf49e0…https://spiderman-one-delta.vercel.app/assets/Home-PduBlHy5.jsyara2026-10-01 00:45
puselili.z20.web.core.windows.net02d0295a…—query2026-09-29 09:02
isoihg-dpnllatkc5tk.edgeone.dev34b12e3c…https://isoihg-dpnllatkc5tk.edgeone.dev/js/HsdqpNsd.jsyara2026-09-28 12:45
isoihg-dpnllatkc5tk.edgeone.dev60395b4d…https://isoihg-dpnllatkc5tk.edgeone.dev/js/HsdqpNsd.jsyara2026-09-28 02:50
pinemamu.z1.web.core.windows.net2748631e…https://pinemamu.z1.web.core.windows.net/i1jgc8m/#htmlyara2026-09-26 05:40
mipipave.z28.web.core.windows.net38a41a2d…https://mipipave.z28.web.core.windows.net/mcily9hd/#htmlyara2026-09-17 11:30
supp0rt-assistance.vercel.app923d4ab0…https://supp0rt-assistance.vercel.app/js/app.jsyara2026-08-30 12:45
uisnasxxii-gzgubwebchcncmbk.z02.azurefd.net21d4cd0c…https://uisnasxxii-gzgubwebchcncmbk.z02.azurefd.net/MacAbhwebsi018/main.jsyara2026-03-20 16:43
uisnasxxii-gzgubwebchcncmbk.z02.azurefd.net21d4cd0c…https://uisnasxxii-gzgubwebchcncmbk.z02.azurefd.net/MacAbhwebsi018/main.js#htmlyara2026-03-20 16:43