Organized Tech-Support Scam Network Abuses Azure Static Sites and Pay-Per-Call Infrastructure Across 80 Organizations
Researchers at PIXM uncovered an organized fraud operation distributing fake Microsoft support pages through paid advertisements, Microsoft Azure Static Website hosting, and a centralized phone-number rotation system. Victims are lured to randomly named *.z13.web.core.windows[.]net pages displaying fake system errors, firewall warnings, and a counterfeit Microsoft support chat, all directing targets to toll-free numbers that can be dynamically rotated via a backend API. One identified backend, linked to Mandarin-speaking developers and registration details referencing Hubei, China, was observed in detections at 11 of the 80 impacted organizations, though researchers caution this is not full attribution. Victims who call risk remote-access abuse, fraudulent repair charges, or financial impersonation.
Detalhes técnicos
The JavaScript loader requests phone numbers via JSONP from call.adhelper[.]cc/api/get-phone.php using an ads_manager identifier, while a separate tracker at adhelper[.]one logs the displayed number, campaign, publisher domain, and ad exchange — architecture resembling legitimate pay-per-call marketing. A hardcoded fallback number exists, meaning takedown of the number-delivery endpoint alone would not fully disrupt the operation. The backend's root page displayed a default Chinese-language BaoTa panel installation message, and the loader contained Simplified Chinese comments and error strings. The adhelper[.]one domain was registered March 10, 2026, with Hubei province listed (self-reported, unverified). The list of advertising-manager identifiers grew from three in May to four in July, with three managers active simultaneously across captured pages, suggesting shared infrastructure among multiple campaign operators. Toll-free numbers were traced largely to Fractel, with no evidence the provider was aware of the abuse; downstream resellers likely supplied the numbers. Tracking parameters revealed ad placements on Whitepages, Legacy.com, Us Weekly, MSN, WordHippo, Juno webmail, KMBC, and US News & World Report. PIXM's prior analysis found advertising identifiers on roughly 60% of detected support-scam pages. The article separately notes Microsoft's documented Storm-1811 campaign abusing Quick Assist to deliver Black Basta ransomware, stating this is enterprise context and not linked to this operation.
Remediação
Defenders should block the published malicious infrastructure, restrict remote-support tool usage to approved workflows, and train staff to close suspicious browser pages rather than call listed numbers, since genuine Microsoft error messages never include phone numbers. Organizations should complement domain-based filtering with browser-content inspection and advertising controls to catch disposable landing pages abusing trusted cloud hosting.
Linha do tempo
-
Organized Tech-Support Scam Network Abuses Azure Static Sites and Pay-Per-Call Infrastructure Across 80 Organizations
ler a análise desta fonte ocultar
Researchers at PIXM uncovered an organized fraud operation distributing fake Microsoft support pages through paid advertisements, Microsoft Azure Static Website hosting, and a centralized phone-number rotation system. Victims are lured to randomly named *.z13.web.core.windows[.]net pages displaying fake system errors, firewall warnings, and a counterfeit Microsoft support chat, all directing targets to toll-free numbers that can be dynamically rotated via a backend API. One identified backend, linked to Mandarin-speaking developers and registration details referencing Hubei, China, was observed in detections at 11 of the 80 impacted organizations, though researchers caution this is not full attribution. Victims who call risk remote-access abuse, fraudulent repair charges, or financial impersonation.
Technical Details
The JavaScript loader requests phone numbers via JSONP from call.adhelper[.]cc/api/get-phone.php using an
ads_manageridentifier, while a separate tracker at adhelper[.]one logs the displayed number, campaign, publisher domain, and ad exchange — architecture resembling legitimate pay-per-call marketing. A hardcoded fallback number exists, meaning takedown of the number-delivery endpoint alone would not fully disrupt the operation. The backend's root page displayed a default Chinese-language BaoTa panel installation message, and the loader contained Simplified Chinese comments and error strings. Theadhelper[.]onedomain was registered March 10, 2026, with Hubei province listed (self-reported, unverified). The list of advertising-manager identifiers grew from three in May to four in July, with three managers active simultaneously across captured pages, suggesting shared infrastructure among multiple campaign operators. Toll-free numbers were traced largely to Fractel, with no evidence the provider was aware of the abuse; downstream resellers likely supplied the numbers. Tracking parameters revealed ad placements on Whitepages, Legacy.com, Us Weekly, MSN, WordHippo, Juno webmail, KMBC, and US News & World Report. PIXM's prior analysis found advertising identifiers on roughly 60% of detected support-scam pages. The article separately notes Microsoft's documented Storm-1811 campaign abusing Quick Assist to deliver Black Basta ransomware, stating this is enterprise context and not linked to this operation.Remediation
Defenders should block the published malicious infrastructure, restrict remote-support tool usage to approved workflows, and train staff to close suspicious browser pages rather than call listed numbers, since genuine Microsoft error messages never include phone numbers. Organizations should complement domain-based filtering with browser-content inspection and advertising controls to catch disposable landing pages abusing trusted cloud hosting.