Fake Microsoft Scanner Secretly Sends Victim Banking and Remote Access Data to Telegram

A new refund scam is using fake Microsoft-branded security scan websites to trick users into removing antivirus software and sharing sensitive information.

The sites, which use names such as SysScan, claim to check whether antivirus software is working correctly. Instead, they display alarming but fabricated warnings and tell visitors that their installed antivirus is causing serious problems.

The pages falsely claim that Windows no longer supports third-party antivirus products and urge users to uninstall them immediately.

This is untrue. Microsoft continues to support third-party antivirus software on Windows. Researchers identified 11 scam sites hosted on the same server.

While the domains use different names, they follow the same pattern: show a fake scan, report severe device problems, collect victim data, and prepare users for a fraudulent refund call.

Fake Scanner Telegram Heist

The scam pages collect browser-accessible data such as operating system details, screen resolution, device memory, processor count, permissions, network information, and browser capabilities. This helps the scan appear legitimate and tailored to the victim’s device.

However, the sites cannot inspect a computer for malware, firmware settings, antivirus status, kernel security features, missing Windows patches, or hardware vulnerabilities.

Despite this limitation, the pages display claims that a browser sandbox is compromised, memory is exposed to Rowhammer attacks, kernel protections are disabled, no Trusted Platform Module is present, or WebRTC is leaking a local IP address.

Many of these warnings are hardcoded into the page. One alleged patch warning uses a randomly generated number, meaning the reported number of missing security updates changes each time the scan runs.

The security score is also manipulated. The code restricts the result to between 13 and 30 out of 100, ensuring that no device can receive a passing score.

The goal is to pressure victims into believing their computer is unsafe. Victims are then told to remove their antivirus software, potentially weakening protection before the next stage of the fraud.

After the fake scan, the sites show a refund form that collects extensive personal and financial data. It requests a victim’s name, address, phone number, email address, bank name, refund amount, cryptocurrency username, and antivirus product.

The form also asks for remote-access software IDs and passwords. Victims can select from around 30 remote-access tools.

Additional fields request an Agent ID, Agent Name, and Company, suggesting that the form may be completed by scammers during a phone call while they guide or control the victim, malwarebytes said.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN