Rise in Tech-Support Scams Abusing Windows Action Center Notifications

The Zscaler ThreatLabz team has observed an increase in tech-support scams that use Windows Action Center notifications to display misleading warning messages to users. These scams now impersonate security providers like McAfee and Avast and use pirated movie streaming websites and social media platforms like X (formerly Twitter) to direct users to fraudulent tech-support pages. The scammers employ tactics such as delayed notifications and explicit images to lure users. Once users allow notifications, they are bombarded with fake infection-related warnings. The scammers use JavaScript code to disable features and lock users out of closing the scam page. The campaigns primarily target users from Australia, Canada, Japan, and the United States. The scammers aim to trick users into calling a fake Windows Support phone number or planting harmful software. It is important for users to stay informed and cautious about these scams. The article also includes a list of indicators of compromise (IOCs) and domains associated with these scams.