A reported support scam sent people from ads on legitimate websites to Azure-hosted pages imitating Windows security warnings, then urged them to call fraudulent support numbers. PIXM reportedly linked the same kit to users at 80 organizations from March through October 2026. New landing pages were reportedly appearing daily as of November 2, 2026.
The scam relied on a browser page and a phone call. Windows was the brand the warnings imitated. This is a separate case from Google’s September investigation into fake Windows and macOS security ads, covered in NeoTeo’s earlier report.
How a fake warning led to a call
The reported route began with an ad on a legitimate website. Clicking it opened an Azure-hosted page with fake Windows alerts, such as “System Error” or “Windows Firewall,” and a support chat directing visitors to a phone number.
The number could change with the ad placement. JavaScript on the page reportedly requested a number from a central service using JSONP, a method for returning data to a webpage script. An advertising parameter selected an operator’s number; the page also had a fallback number. A tracking pixel reportedly recorded the displayed number, campaign, publisher website and advertising exchange.
A call could expose someone to pressure to install remote-access software, pay for unnecessary repairs, or follow a refund or bank-impersonation scheme. The reported activity centered on the fake warning page and support call.
What the 80- and 11-organization figures count
The two figures describe different scopes of the reported operation.
| Figure | Scope | What was counted |
| 80 organizations | The same kit, March–October 2026 | Organizations whose users were exposed to scam pages |
| 11 organizations | The specific backend PIXM examined | Organizations associated with that backend |
The 80 figure is exposure to scam pages, not confirmed breaches; the 11 figure concerns the narrower backend association.
What to do when a warning demands a call
Close the suspicious browser tab or quit the browser, and do not call the number shown on the page. For security teams, the reported recommendations include blocking identified infrastructure with DNS controls or a secure web gateway, and limiting remote-access software to approved support workflows. Blocking a phone service alone may not stop the scam because the pages included a fallback number.
