Fake Microsoft Security Scan Popups Are Tricking Users Into Deleting Their Antivirus

Fake Microsoft Security Scan Popups Are Tricking Users Into Deleting Their Antivirus — A Breakdown of the SysScan Scam

If you're in security, IT support, or just building things on the web, this one is worth knowing about — not just to protect yourself, but because it's a solid case study in how far social engineering has moved away from relying on actual exploits.

Malwarebytes recently uncovered a network of 11 fake websites branded "SysScan," impersonating Microsoft-linked security scans. The interesting part isn't just that they're fake — it's how the fake scan is engineered.

The "security score" these sites generate is hardcoded to always land between 13 and 30 out of 100, regardless of the device, browser, or antivirus software being tested. There's no actual detection logic running client-side — it's a scripted result designed purely to alarm the visitor. A passing score is not a possible outcome.

The attack chain looks like this:

1. Victim lands on a Microsoft-branded page running a "live" security scan.
2. The scan returns a low score and blames the installed antivirus for fabricated vulnerabilities.
3. The victim is instructed to uninstall their real antivirus to "fix" the issue.
4. Once unprotected, they're redirected to a fake refund form requesting banking details, crypto wallet usernames, and remote access credentials.
5. Submitted data is exfiltrated directly to a Telegram bot via Telegram's Bot API.
6. A fake "refund manager" calls within minutes, posing as legitimate support.
7. The caller requests remote access "to process the refund" — this is the actual compromise point.

From a technical standpoint, what stands out is the complete absence of malware, exploit code, or drive-by downloads. There's no payload to detect or sandbox. The entire operation runs on front-end deception, a fake progress bar/scan animation, spoofed branding, and a well-timed phone handoff that exploits trust built during the "support" flow.

This is a good reminder for anyone building trust-and-safety tooling, browser security features, or fraud detection systems: attackers are increasingly optimizing for social engineering over technical exploitation, because it bypasses most technical defenses entirely. No antivirus flags a convincing website with a fake progress bar.

I wrote up the full technical breakdown, including the identified scam domains, the exact data flow into Telegram, and recovery steps for anyone who already fell for it:

https://www.xpert4cyber.com/2026/08/fake-microsoft-security-scan-sysscan-scam.html

If you work in security, support, or just want to understand how these scams are engineered under the hood, it's worth a read — and worth sharing with less technical friends/family/users who are the actual target demographic here.