Security researchers got inside the system that sends people to fake Microsoft warnings. Here is how the scam works and how to spot it.
Researchers at the security firm Infoblox got access to the control panel of Help TDS, a system that sends web visitors to fake Microsoft support alerts. The alerts push people to call a phone number. In one test call, the person on the line tried to get a researcher to install remote-control software. Dark Reading reported the findings on October 19, 2026.
Help TDS is a traffic router. It checks each visitor, including their location and browser details, then decides whether to send them to a tech-support scam or to another paid destination. The scam page can look like a Windows update or a security warning. It may lock the browser, sound alarms and show a phone number to call.
Infoblox vice president Renée Burton hit one of these pages in mid-June 2026 and called the number. The supposed Microsoft agent asked her to download UltraViewer, a tool that lets someone else control your computer. The call lasted 13 minutes. It was part of an investigation, and no victim loss was reported.
Website owners are part of the story too. GoDaddy Security describes a malicious plugin called woocommerce_inputs that redirected site visitors into these scams. GoDaddy estimates it reached more than 10,000 websites worldwide. Version 1.5 also sent WordPress usernames, email addresses, display names and site addresses to Help TDS. GoDaddy says the plugin has no link to WooCommerce or Automattic, and the findings do not concern the official WooCommerce software.
Anyone who browses the web can land on one of these pages, and Windows users are the main target of the Microsoft disguise. Infoblox says Microsoft is simply the brand being faked. Microsoft says its real warnings never include a phone number and that it does not make unsolicited support calls. If you never run a WordPress site, the plugin part is not your concern.
Infoblox also shared exposure numbers, but they cover only its own cloud customers. Exposure fell below 0.5% in September 2026, after a one-day peak of up to 4%. That drop followed new detection methods and does not describe the wider internet.
The alert box above lists the steps. The short version: treat any warning that shows a phone number as fake, never give a caller remote access, and use only official Microsoft help. WordPress owners should check their sites for the plugin.
The operation looks built to keep moving. Infoblox says the group behind it, which it calls Hotejka, began using disposable Cloudflare Pages sites in April 2026 and made roughly 300 pages a day. Infoblox detected more than 16,000 domains used for Help TDS through mid-September. It says a prediction tool added in July 2026 often flagged domains about seven days before the group announced them.
The material does not say whether the panel has been shut down or whether anyone faces charges. Until that changes, expect the fake warnings to keep appearing.
A warning on your screen that shows a phone number is a scam, so do not call it and never let a stranger install remote-control software.
Scammers are emailing Humboldt County well permit applicants and demanding $5,960 before a permit is issued. The county says the fee is fake.
Read more: Fake County Emails Demand $5,960 Fee for Well PermitsCallers posing as the Sheriff's Office told a Sarasota County woman she missed jury duty. She lost over $40,000, and the same scam is hitting others.
Read more: Fake jury duty calls cost one Florida woman over $40,000Europol warns that scam callers can fake the number on your screen, so the safest move is to hang up and call back using a number you found yourself.
Read more: Got a suspicious call? Hang up and look up the number yourself
