A new tech support scam campaign has abused malicious Bing search ads to redirect U.S. users to fake Microsoft Azure support pages hosted in cloud storage.
According to researchers at Netskope Threat Labs, the activity began on February 2 at around 16:00 UTC and quickly impacted users across 48 different organizations.
All identified victims were based in the United States and came from multiple industries, including healthcare, manufacturing, and technology. The scale and speed of the campaign stood out, especially because it relied on paid search ads rather than phishing emails or social media links.
The infection chain began with a simple action: a user searched for a common term, such as “amazon,” on Microsoft Bing.
Instead of clicking the legitimate website directly, victims clicked a malicious advertisement placed within the search results.
This highlights a key security lesson: directly typing a known URL, such as Amazon.com, is safer than searching for it and clicking ads. Sponsored search results can be abused by threat actors who pay to place malicious links above legitimate results.
When users clicked the malicious ad, they were first redirected to a newly registered domain hosting an empty WordPress site. That site then redirected traffic to pages hosted in Microsoft Azure Blob Storage containers.
Abuse of Azure Blob Storage
The final scam pages were hosted in Azure Blob Storage, a legitimate cloud storage service. Attackers created multiple storage containers with random names.
Key characteristics included:
- Randomly generated container names
- A fixed path ending in werrx01USAHTML/index.html
- A query parameter containing a phone number
The phone numbers embedded in the URLs were part of the scam. Victims were instructed to call numbers such as:
- 1-866-520-2041
- 1-833-445-4045
- 1-855-369-0320
- 1-866-520-2173
- 1-833-445-3957
Once on the page, users were shown a typical tech support scam message warning them of fake security issues and urging them to call “Azure Support.” The goal was to convince victims to grant remote access or share payment details.
Standardized Infrastructure
Researchers observed dozens of Azure Blob container domains following the same naming pattern.
This suggests a standardized and automated deployment method, allowing attackers to quickly spin up new containers if older ones are taken down.
This tactic is not new. Tech support scammers have previously abused platforms such as DigitalOcean and StackPath to host phishing content.
However, the successful placement of malicious ads in Bing search results significantly increased the campaign’s reach.
Netskope detects these pages as “ET PHISHING Microsoft Support Phish Landing Page.” All identified Azure Blob Storage domains were reported to Microsoft and were no longer serving malicious content at the time of publication.
Organizations should:
- Train users to avoid clicking sponsored search results for well-known brands
- Encourage direct URL navigation for trusted sites
- Monitor DNS and web traffic for suspicious blob.core.windows.net patterns
- Block known scam phone numbers at the network level
This campaign demonstrates how threat actors continue to weaponize legitimate cloud services and advertising platforms to scale traditional tech support scams.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
