Tech support scams have always been a problem, but they typically were located on small web hosting services throughout the world. Researchers have now observed these scams increasingly moving towards the Microsoft Azure cloud platform for ease of deployment and inexpensive web hosting.
Microsoft Azure has a feature called App Services that allows you to quickly and easily mass deploy web sites to the cloud. When a web site is deployed in Azure, they will be hosted on the azurewebsites.net domain using names like my-app-name.azurewebsites.net.
When these sites were found, JayTHL has been reporting them to Microsoft using their abuse API. Unfortunately, due to the overwhelming amount of abuse reports Microsoft receives, these links can stay active for 4-5 days before Microsoft shuts them down.
This gives the scammers plenty of times to create new Azure accounts and mass deploy another batch of web sites to display tech support scams.
Mostly Apple and Microsoft tech support scams
When BleepingComputer examined some of the URLs shared by MalwareHunterTeam with us, we saw that all of these scams were pretending to be support sites for Microsoft and Apple.
One of the advantages of using Azure to host your site is that every web site is secured using a SSL certificate from Microsoft. This can make some users think that they are on a legitimate site owned and operated by Microsoft.
Many of these scam sites also utilize techniques to lock up the browser or prevent you from leaving the site. Therefore, to close these scams you typically have to close the tab, and if not possible, the browser process itself.
In addition to tech support scams, phishing sites are moving to Azure cloud services as well. As you can see below, a fake Microsoft account login screen is being hosted on azurewebsites.net.
Azure App Services is not the only Azure service being used to host phishing scams. Scammers are also utilizing Azure Blob Storage to store their phishing scams.
Sites hosted on blob storage will utilize the hostname .blob.core.windows.net and also take advantage of a Microsoft SSL certificate.
Code Execution Vulnerability Identified in Change Healthcare Cardiology DevicesA vulnerability has been identified in Change Healthcare Cardiology, McKesson Cardiology, and Horizon Cardiology devices. The vulnerability could be exploited by a locally authenticated...
29% of Small Businesses Spend Less Than $1,000 on IT Security Annually and Why They Are The Most Targeted
29% of Small Businesses Spend Less Than $1,000 on IT Security Annually and Why They Are The Most TargetedThe digital and network footprint of small businesses is continually growing. Online commerce, social media, remote workers, and cloud-based IT infrastructure are...
What Other Companies Can Learn from Facebook’s $5 Billion Fine and Why Privacy MattersWhile Facebook’s $5 billion settlement stands as the largest fine in the history of the Federal Trade Commission (FTC), one must take into consideration that not every company is...
Stay Up to Date With The Latest News & Updates
Join Our Newsletter
Get weekly tech updates and immediate alerts when there is a zero-day or security issue!