A Fake Microsoft Lock Screen, a Phone Call and a Remote Desktop Download: Inside a Long-Running Tech Support Scam, and the Layers That Stop It

Here Is How Layered Defenses Help When the Scam Comes With a Phone Number

Fake “your computer is infected” pop-ups can sound like a consumer problem. The operation researchers just documented shows why they belong on a business security agenda: the goal is not a one-time gift card payment but remote control of the computer, the kind of access that, in the researchers’ words, lets the attacker come back again and again.

This briefing is based on Dark Reading’s report on the investigation and Infoblox’s research write-up.

What an employee would experience

It usually starts with an ordinary click: a hacked website, a malicious ad, a social media post or spam. Behind the scenes, a traffic distribution system called Help TDS fingerprints the visitor’s browser and location and decides where to send them. Some visitors are routed to the scam.

Those visitors see a Windows-style notice that an update is needed and the PC will restart. Whatever they click, the screen flashes, a fake Windows error appears, and then a fake Microsoft security warning claims access to the device has been blocked. Alarms sound, a computerized voice tells them not to restart, and a “Microsoft” support number fills the screen. Infoblox says the browser lock is hard to escape and disables keyboard input.

Infoblox’s vice president of threat intelligence, Renée Burton, called one of the numbers. A man who said he worked for Microsoft support, in what sounded like a busy call center, promised there would be no charge, had her sign out and back in, and then directed her to the site for UltraViewer, a free remote desktop tool. The 13-minute call ended abruptly when she questioned the download.

Who is behind it

Infoblox assesses that Help TDS is run by Hotejka, a small Russian-language advertising affiliate program that appears to be a rebrand of an outfit exposed in 2018, and that the system has been active since at least 2017. More than a dozen “affiliates” feed it traffic, including the operators of the Balada Injector and DollyWay website malware campaigns, which compromise WordPress sites.

Since April 2026 the scam pages have lived on free Cloudflare Pages sites. Infoblox detected more than 20,000 such domains in six months, about 300 new ones a day, plus roughly 10,000 more that appear tied to phishing or decoys. The operators rotate their command-and-control domains every five minutes through a Telegram channel. When the move to Cloudflare began, up to 4% of Infoblox’s cloud customers were exposed to Help TDS on a single day. Infoblox says it reported recent domains to Cloudflare, which is reviewing them.

Layer by layer: where the chain breaks

Layer 1: The web filter

DNS filtering and secure web gateways can block known malicious and newly created domains before the page ever loads. Infoblox says it now predicts this group’s domains about seven days before they are used, which shows how much a protective DNS layer can catch. Microsoft Defender SmartScreen and network protection are examples on Windows; many DNS and firewall vendors offer equivalents.

Layer 2: The browser

Managed browsers with ad and pop-up controls shrink the malvertising path. Teach staff that a browser tab cannot lock a computer: closing the browser through Task Manager, or restarting, ends the “lock,” despite what the voice says.

Layer 3: The human

The single most useful rule: Microsoft does not put phone numbers in security warnings, and your company’s IT support has its own known number. Post that number where people will see it, and make calling it the reflex.

Layer 4: The endpoint

Standard user accounts without admin rights, plus application control that allows only approved remote support tools, mean a downloaded remote desktop program either will not install or will raise an alert. Windows tools such as App Control for Business or Intune policies are one way to do this; third-party endpoint tools work too.

Layer 5: Detection and response

Endpoint detection should flag a newly installed remote access tool making outbound connections. If it happens, disconnect the machine, reset the user’s passwords from a different device and check for persistence before reconnecting.

Layer 6: Your own website

Part of this scam’s traffic comes from hacked WordPress sites. Keeping your site’s plugins patched and admin logins protected keeps your business from becoming the on-ramp for someone else’s customers.

What this means for your company

Tech support scams succeed on panic, so the best investment is a calm, rehearsed response. This week, tell every employee in one short message: real Microsoft warnings never ask you to call a number; if your screen “locks,” call our IT contact. Then check the technical side: are standard users unable to install software, and would you know if a new remote access tool appeared? Products mentioned here are examples. The protection comes from stacking several of these layers so one miss does not become a breach.

Need help putting layered protection and a simple employee playbook in place against tech support and remote access scams? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.