Filed under: Cybersecurity — Phishing & Scams — August 2026
What happened
Researchers at Malwarebytes found a network of fake Microsoft-branded websites running phony “security scans.” The sites tell visitors their antivirus software is incompatible with Windows and must be uninstalled immediately — a completely false claim. Once a victim removes their real protection, the site pushes them into a fake refund process that harvests their name, address, banking details, cryptocurrency accounts, and even remote-access tool credentials, sending everything straight to the scammers via a Telegram bot. Researchers found eleven of these lookalike domains running on a single host.
Why it matters to your business
This scam is built to hit exactly the moment an employee is trying to do the right thing — checking that their PC is secure. If someone on your team hits one of these sites and follows the instructions, you end up with an unprotected computer, a scammer with your banking information, and potentially a stranger with remote access to a company machine. That last part is the real danger for a small business: one compromised PC with remote-access software installed can be a foothold into your whole network.
What to do this week
Remind your team that Microsoft does not run pop-up “security scans” from a website and will never ask you to uninstall your antivirus. If a scan result urges uninstalling security software, closing the browser tab is the right move — not calling a number or filling out a form. If anyone on staff already removed their antivirus or installed a remote-access tool because of a prompt like this, disconnect that PC from the network, reinstall your standard endpoint protection, and run a full scan before reconnecting. If banking details were entered anywhere, call your bank directly using the number on your card, not anything from the scam page.
The bigger picture
Scams like this work because they borrow trust from a brand everyone already relies on — and they’re getting more automated, routing stolen data through commodity tools like Telegram bots instead of custom infrastructure. — Fake Microsoft security scans trick victims into uninstalling their antivirus
Would your team know to close the tab instead of calling the number? Book a free consult — https://micro1tech.com/contact/