A massive new campaign utilizing the CypherLoc scareware kit to trick users into calling fraudulent technical support lines.
Since the beginning of 2026, security teams have tracked approximately 2.8 million attacks leveraging this sophisticated framework.
CypherLoc highlights a significant evolution in cyber threats, demonstrating how modern scareware has shifted away from simple frozen-screen scams and traditional malware installations.
Instead, it relies on stealthy, browser-resident attack frameworks that weaponize user fear to achieve their malicious goals.
CypherLoc Fuels Support Scams
The attack chain typically begins with a targeted phishing email containing a malicious link or a weaponized attachment. When a user clicks the link, they are directed to a web page that initially appears completely harmless.
However, this landing page serves as a staging ground, housing a hidden, encrypted payload that only executes under highly specific conditions.
If the conditions are met, the original page is erased, and a new scareware interface is dynamically loaded. To understand how CypherLoc maintains stealth, researchers mapped out its initial technical execution flow:
- Payload extraction: The script uses JavaScript to extract the encrypted payload from a hidden HTML element by reading its text content.
- Prerequisite validation: It actively verifies that both the encrypted blob and the URL fragment are present, halting execution if either is absent.
- Data decoding: The framework Base64-decodes the encrypted data to separate components, such as the initialization vector and the ciphertext.
- Integrity and decryption: It recomputes an HMAC check to confirm the blob remains unaltered, then decrypts the payload using AES encryption with a key derived directly from the URL fragment.
- Trace removal: The malware uses the history replacement state function to scrub the URL fragment from the browser history, hiding obvious traces of the gating value.
- Final execution: The decrypted JavaScript string is executed, instantly launching the hidden scareware environment.
| Technical Code String | Activity Description |
|---|---|
document.getElementById('enc_...')blobNode.textContent.trim() | Pulls the encrypted payload out of a hidden HTML element on the page (reads the text content that contains the encrypted “blob”). |
if(!blob || !location.hash) | Checks the two prerequisites are present: (1) the encrypted blob and (2) the URL “hash/fragment” (the part after #). If either is missing, it stops and redirects to a blank page. |
According to Barracuda research, the scareware presents spoofed login forms. These inputs never process credentials; instead, they serve as legitimacy bait to keep the user engaged on the page.
When the victim enters their username and password, the deliberate failure to resolve the locked screen only escalates their sense of entrapment.
Throughout this orchestrated chaos, a fraudulent support number remains prominently displayed as the sole solution.
Victims who call the number are connected to human operators posing as Microsoft support staff, who utilize social engineering to complete the financial scam.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
