Fake Microsoft Support Scams Spread Through Online Ads as Researchers Uncover Organized Fraud Network

An organized fraud operation using paid advertisements, Microsoft Azure hosting, and centrally managed telephone numbers to distribute counterfeit Microsoft support pages.

The investigation links one backend serving the kit to Mandarin-speaking developers and registration details referencing Hubei, China.

Those findings suggest operational connections, not definitive attribution. Crucially, the identified backend appeared in detections at 11 organizations; researchers did not attribute all 80 organizations’ encounters to that operation.

The destination is typically a randomly named Azure Static Website under *.z13.web.core.windows[.]net, presenting fake “System Error” alerts, Windows Firewall warnings, and an imitation Microsoft Support chat. Every prompt pushes visitors toward a toll-free number.

The infrastructure’s distinguishing feature is centralization. JavaScript requests a telephone number from call.adhelper[.]cc/api/get-phone.php through JSONP, passing an ads_manager identifier.

This lets operators rotate numbers across deployed pages without rebuilding each landing site.

A separate tracking request to adhelper[.]one records the displayed number, campaign, publisher domain, and advertising exchange.

The architecture resembles pay-per-call marketing: individual buyers receive attributable numbers, allowing operators to associate incoming calls with specific campaigns.

The script also contains a fallback telephone number. Consequently, disrupting the number-delivery endpoint alone may not eliminate every callback path.

Researchers found Simplified Chinese comments and error messages in the loader, including instructions describing impression tracking and fallback behavior.

Another captured page displayed a counterfeit fullscreen notification copied from a Chinese-language browser.

The backend’s root page displayed the default Chinese-language installation message for BaoTa, a server administration panel.

PIXM security observed that, the kit reached users at 80 organizations, with fresh landing pages still appearing daily on November 2.

Registration records for adhelper[.]one, created March 10, 2026, listed Hubei province, although such details are self-reported.

Fake Microsoft Support Scams

The advertising-manager list expanded from three identifiers in May to four in July, adding “xiaofeng.”

Three managers were active across captured pages connected to this backend, supporting the assessment that multiple campaign operators shared infrastructure.

Public toll-free registry records associated most searchable numbers with Fractel during the relevant months, including sequential number blocks.

PIXM found no evidence that the provider knew about the abuse; downstream resellers can supply customers.

Tracking parameters named placements on Whitepages, Legacy.com, Us Weekly, MSN, WordHippo, Juno webmail, KMBC, and US News & World Report’s health pages. Their appearance identifies advertising inventory, not publisher complicity.

PIXM’s earlier delivery analysis found advertising identifiers on roughly six in ten detected support-scam pages.

Operators shifted between advertising channels while reusing substantially similar landing pages, illustrating why email controls alone miss this exposure.

The danger escalates when victims call. Fraudsters can request remote access, demand payment for fictitious repairs, or pivot into financial impersonation.

Separately, Microsoft documented Storm-1811 abusing Quick Assist in social-engineering attacks leading to Black Basta ransomware; that establishes enterprise relevance, not a connection to this operation.

Defenders should review the published indicators, block malicious infrastructure, and restrict remote-support tools to approved workflows.

Staff should close suspicious pages rather than call: Microsoft states that genuine error and warning messages never include telephone numbers.

Browser-content inspection and advertising controls should complement domain-based filtering, particularly where disposable landing pages exploit trusted cloud hosting.

IOCs

Indicator	Type	Role
call.adhelper[.]cc	Hostname	Phone-number API (/api/get-phone.php)
adhelper[.]cc · aff.adhelper[.]cc	Domain	Back end / affiliate subdomain
adhelper[.]one	Domain	Impression tracker (on registrar hold since Oct 22)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.