Fake Microsoft "SysScan": Bogus Security Scanner Invents Problems, Tricks Victims Into Uninstalling Their Antivirus, Then Funnels Them Into a Refund Scam
Overview
On August 24, 2026, Malwarebytes disclosed a wave of websites calling themselves "SysScan," carrying Microsoft branding, claiming to check whether your antivirus (AV) software is working. Every one of these sites reaches the same conclusion: your computer has serious problems, and the cause is the antivirus software you installed.
The sites claim Windows no longer supports third-party antivirus and instruct victims to uninstall it immediately. This is false — and it's the first step in a refund scam designed to get victims on the phone, remove their security software, and ultimately hand over personal, banking, and remote-access information.
Malwarebytes found eleven of these sites on a single host. Although the names vary, all of them work essentially the same way: run a convincing-looking but entirely fake security scan, tell the victim their antivirus is causing problems, collect their personal information, and prepare them for a supposed refund phone call.
The key thing to remember: A website cannot run a real security scan. It can only read basic browser data — your operating system, screen size, and approximate location — not check for malware, memory issues, or missing security patches. Microsoft continues to support third-party antivirus, and legitimate refund processes never require uninstalling security tools or installing remote-access software.
About the Scam Campaign
This is not an APT campaign with clear nation-state or named-group attribution — it's a scam operation in the "tech support scam" / "refund scam" tradition, significantly upgraded with AI tooling, both in its fabricated content and its operational infrastructure.
| Attribute | Detail |
|---|---|
| Campaign name | SysScan (self-branded, impersonating Microsoft) |
| Threat type | Refund scam combined with brand impersonation and tech-support scam tactics |
| Infrastructure scale | 11 websites discovered on a single host |
| Data collection channel | Sent directly via the Telegram Bot API — no application backend |
| Targets | Individual consumers and enterprise computer users (the AV list includes enterprise security software) |
| Technology signals | Clear evidence that both the code and the on-page video were AI-generated |
A notable infrastructure detail: none of the 11 sites have their own application backend — all collected data is bundled together and sent directly to the Telegram Bot API. This makes the sites extremely cheap to run and easy to abandon the moment they're flagged or detected, with new sites spun up almost instantly — a classic "use once, discard fast" operating model for scams at scale.
Technical Analysis
1. The scan reads real data but draws entirely invented conclusions
Part of what makes this scam convincing is that the page does measure some real things. It reads information that a browser legitimately exposes — your user agent, screen dimensions, device memory, processor count, permission states, network information, available web features, and some page performance timings. This makes the results appear specific to your machine.
But the security conclusions are not connected to any of those measurements. Fifty of the findings are fixed text written directly into the page's source code, grouped into blocks that the developer labeled as "fake checks" in the code itself.
Among them are claims that your browser sandbox has been compromised, kernel page-table isolation is inactive, your memory is vulnerable to Rowhammer, no Trusted Platform Module (TPM) was found, WebRTC is leaking your local IP address, and your processor is thermally throttled. A web page has no way to determine any of these things.
One finding even reports how many days behind your security patches are — using a random number generated fresh each time the check runs. Run the scan again, and you get a completely different number.
Even checks that use genuine information get twisted into warnings: an encrypted connection becomes a "downgrade risk"; cookies enabled triggers a warning; cookies disabled is a failure; ordinary features found in modern browsers are flagged as ways to fingerprint you. Even Malwarebytes's own fully updated test browser was reported as "possibly outdated."
The most telling detail: the resulting score is hard-coded directly in the source, constrained to a range of 13 to 30 out of 100. The page cannot report anything above 30, regardless of the actual condition of the computer being tested.
Passing is not a possible outcome.
2. Why the scam always tells you to uninstall your antivirus
Telling someone to remove their antivirus is the single most consequential action these pages take, and it serves two purposes at once:
It removes software that could interfere with what comes next — including any remote-access software or anything else installed later in the session.
It tells the scammers exactly which security product the victim uses.
The site records which antivirus was removed, selected from a list of 28 named products, plus an "Other" option. Notably, enterprise security software also appears on this list — suggesting the scam has been prepared specifically for victims using work computers.
The claim that "Windows no longer supports third-party antivirus" is made more believable by distorting something that is actually true: Windows does include its own antivirus — Microsoft Defender Antivirus. When a compatible third-party AV product is installed, Defender can move into a passive state because the other product is providing protection. That does not mean Windows no longer supports third-party antivirus.
3. The form appears built for the scammer, not the victim
After the "scan," the site presents a customer information form. It collects: name, address, phone numbers, email address, refund amount and reason, bank name, cryptocurrency username, the AV product used, and the ID and password for a remote-access session. Users can choose from 30 different remote-access tools.
The form also requires: Agent ID, Agent Name, and Company. These fields strongly suggest the form is designed to be filled in by the scam operator during the phone call — potentially while they're viewing the victim's screen live. The code itself doesn't prove who actually types the information, but there is little legitimate reason for "agent" fields to appear on a form ostensibly intended solely for the customer.
One field even asks whether explicit content is involved. Embarrassment and shame are powerful tools for scammers, because victims may become less willing to discuss what happened with a partner, family member, or their bank.
When the form is submitted, the browser bundles the customer, agent, remote-access, antivirus, and banking details into a single message and sends it directly to the Telegram Bot API. No application backend is involved — keeping the sites cheap to host and easy to abandon once they attract attention.
This also exposes another lie. The site states in several places that "no data is sent and nothing is collected." Even before the form is submitted, however, it already contacts external IP and geolocation services. Once the form is submitted, everything entered is sent to a Telegram group chat.
4. Then comes the supposed refund call
After submitting the form, the victim is sent to a page stating that a refund manager will call within three to five minutes. The page plays a looping video of a man in an office, and prevents the victim from pausing it, switching to full screen, or opening the right-click menu.
The video's content essentially reassures the victim that their request has been received and is under review, that a "refund manager" will contact them shortly to verify their information, and instructs them to keep their phone nearby and be ready to answer. Its evident purpose is to keep the victim on the page while the call is arranged, and to reassure them that an official process is underway.
Whether the eventual caller is a different scammer isn't something the code can confirm, but the structure creates a very clear handover point between the web-based phase and the phone-based phase of the scam.
By the time anyone starts asking about bank details, the victim has already: seen a Microsoft-branded security scan, been told their computer has serious problems, removed their own antivirus, and entered information into what looks like an official refund process.
5. The site shows clear signs of AI-generated code
The video on the waiting page is synthetic, and the clip appears zoomed and cropped within its frame — a telltale sign of AI-generated content dropped into a pre-built layout.
The code shows similar signals. It is heavily commented in the explanatory, self-narrating style commonly produced by AI coding tools — including notes explaining why the scan is deliberately paced, and why the spoken lines use a terse, security-console-style tone.
More notably still, some comments describe the deception directly: eight blocks of invented findings are explicitly labeled "fake" right in the code, while around 20 checks that read genuine values are described as "exaggerated." One comment near the top of the file even states that "no data leaves the device" — a few hundred lines before the very function that sends the form data to Telegram.
Source code alone cannot prove how it was created. But the fraud-specific elements — including the US bank list, agent identifiers, and the explicit-content field — appear to have been fitted into a broader, more generic scanner template, suggesting a development process combining an AI-generated technical framework with human-added fraud-specific elements.
How to Spot a Fake Computer Security Scan
Malwarebytes lists several warning signs that give away scams like this:
A website claims to find "deep" problems with your computer. A web page can see some information your browser provides, but it cannot inspect firmware settings, antivirus status, memory vulnerabilities, or your exact Windows patch level.
Every result is bad. A diagnostic that cannot produce a passing result isn't really diagnosing anything.
You're told to uninstall your antivirus. Microsoft continues to support third-party security software on Windows.
You're asked to install remote-access software. Legitimate refunds do not require someone to take control of your computer.
You're asked for banking or cryptocurrency information. A legitimate company should not need remote access or cryptocurrency to process a refund.
The page relies on a familiar logo. A Microsoft or Apple logo on a website does not mean the company operates it — these sites can switch branding depending on the operating system they detect.
If This Has Already Happened to You
Disconnect your computer from the internet and remove the remote-access tool if you installed one or allowed someone to control your computer.
Reinstall the antivirus software you were told to remove, update it, and run a full system scan.
If you gave the scammers banking information or allowed access to your online banking: contact your bank immediately using a phone number you look up yourself — never a number provided by the scammer.
Change your email and banking passwords from a different, trusted device.
If money was taken, report the scam to the Federal Trade Commission (FTC) at
reportfraud.ftc.govand the FBI's Internet Crime Complaint Center (IC3) atic3.gov.Don't let embarrassment stop you from telling your bank or someone you trust what happened. Creating that embarrassment is part of the scam itself, because it makes victims less likely to ask for help. Acting quickly gives you the best chance of limiting any loss.
Risk Summary
| Risk Dimension | Level | Rationale |
|---|---|---|
| Deceptiveness | Very High | Combines real browser data + Microsoft branding + a real-time AI reassurance video |
| Potential financial impact | Critical | Directly harvests banking information, cryptocurrency details, and full remote-access control of the computer |
| Infrastructure stealth | High | No backend; uses Telegram Bot API as the data-collection channel — cheap, fast, and easy to abandon once detected |
| Difficulty of technical detection | High | No traditional malware payload for AV/EDR to scan; the entire operation is web-based social engineering |
| Potential victim reach | Broad | Both individual consumers and enterprise computer users (the AV list includes enterprise products) |
| Psychological impact | Concerning | The "explicit content" form field is designed to create shame and isolate victims from sources of help |
IOCs & Artifacts
Hosting
| Indicator | Type |
|---|---|
157.230.180.90 |
Shared hosting IP for all 11 sites |
Domains
detectsysscanner[.]at
detectsysscanner[.]com
detectsysscanner[.]de
detectsysscanner[.]in[.]net
detectsysscanner[.]xn--q9jyb4c
detsysscanner[.]com
detsysscanner[.]de
detsysscanner[.]xn--q9jyb4c
techsysscanner[.]com
techsysscanner[.]lol
tlcscanner[.]com
Behavioral Indicators
The reported "security" score always falls within the 13–30/100 range, never exceeding 30.
The "days behind on patches" result changes randomly each time the scan is re-run on the same machine — direct evidence that no real check is taking place.
The page blocks right-click, fullscreen, and pausing on the "waiting for a call" video.
The AV selection list contains exactly 28 products plus an "Other" option.
The remote-access tool selection list contains 30 different tools.
All form data is transmitted via the Telegram Bot API, with no dedicated application backend.
TTP Mapping
Note: This is a social-engineering campaign targeting end users directly, not a typical enterprise network intrusion chain. As a result, the MITRE ATT&CK Enterprise framework only applies partially — the table below lists only the techniques that genuinely match observed behavior, rather than force-fitting every tactic.
| Tactic | Technique ID | Technique Name | Description in Campaign |
|---|---|---|---|
| Resource Development | T1583.001 | Acquire Infrastructure: Domains | 11 domains registered, hosted on a single shared IP |
| Resource Development | T1608 | Stage Capabilities | Building the fake "scan" page, AI-generated video, and data-collection form |
| Defense Evasion (of the campaign itself) | T1656 | Impersonation | Impersonating Microsoft's brand and credibility |
| Initial Access | — | (Not specified in the original report) | Malwarebytes did not identify the specific vector bringing victims to these sites (possibly malvertising, poisoned search results, or direct links) |
| Execution | T1204.002 | User Execution: Malicious File | Victim self-installs remote-access software following on-page instructions |
| Defense Evasion | T1562.001 | Impair Defenses: Disable or Modify Tools | Tricking the victim into personally uninstalling their own antivirus (via social engineering, not a technical exploit) |
| Command and Control | T1102.002 | Web Service: Bidirectional Communication | All collected data sent directly via the Telegram Bot API |
| Collection | — | (No standard ID) | Data collected via a deceptive web form, not through an intrusion technique |
| Remote Access | T1219 | Remote Access Software | 30 different remote-access tools offered for selection |
| Impact | T1657 | Financial Theft | The ultimate goal: financial theft via a fake "refund" scenario and harvested banking/cryptocurrency information |
Assessment
The SysScan campaign is a clear demonstration that AI is lowering the barrier not only for technical malware development (as seen in complex APT/cybercrime campaigns), but also for running far more sophisticated social-engineering scams than the crude, easily-recognized tech support scams of the past.
The key technical insight: this isn't a crudely "fake" scan — it reads real browser data (device specs, configuration, performance) to build credibility, while every security conclusion is a pre-written script entirely disconnected from the data actually read. This is a form of deliberate deception, fundamentally different from unintentional AI "hallucination" — here, a human actively programmed the system to always produce a negative verdict, regardless of the machine's actual condition. The score being hard-capped at 13–30/100 directly in the source code is irrefutable technical proof: there is no scenario in which a genuinely clean system could ever "pass" — this isn't diagnosis, it's a predetermined outcome dressed up as one.
The use of the Telegram Bot API as the data-collection channel (eliminating the need for a dedicated backend) reflects a broader trend seen across many different types of threat actors today: leveraging legitimate, readily available service infrastructure as an exfiltration sink — reducing operational cost while increasing survivability, since taking down a domain is far easier than getting Telegram to shut down a specific bot.
The appearance of an "explicit content" field in the form is a notable detail from a scam-psychology perspective: the operators clearly understand that shame is an extremely effective tool for isolating victims from their support network (family, bank, friends). This tactic isn't new in scams generally, but standardizing it into a mandatory form field shows just how systematized the entire operation is — this isn't an improvised con, but a tested and optimized process.
The list of 28 AV products plus enterprise security software shows the campaign isn't targeting home users alone — it has specifically prepared for victims using work computers. This is a point that organizations, especially internal IT/helpdesk teams, need to build into employee security-awareness training, since an employee tricked into uninstalling AV on a company machine can open the door to consequences far beyond a simple personal scam.
For Vietnamese readers and organizations: while the current IOCs (domains, IPs) show no direct evidence of targeting Vietnamese users, the operating model (a fake scan wearing a familiar brand + a refund-call scenario + a C2 channel through a legitimate chat service + AI-generated content) is a highly reusable, easily localized template. It's entirely plausible that a similar variant will emerge in the near future under a different brand — impersonating a telecom carrier, a bank, an e-wallet, or a well-known security vendor popular in Vietnam. This is a threat type that belongs in end-user security-awareness programs, not just technical teams — because the most effective defense against this kind of scam isn't software, but the user's own informed skepticism when confronted with a "scan result" too alarming to be true.
Recommendations
For individual users
Never trust "security scan" results from a random website, no matter how familiar the logo looks — a browser has no ability to check for malware, firmware issues, or real antivirus status.
Never uninstall your antivirus at the request of a website or phone call — verify any claimed issue directly through your AV vendor's or Microsoft's official channels.
Never install remote-access software based on instructions from a website or from someone claiming to be a "refund manager" or "technical support agent."
Never enter banking or cryptocurrency information into any form that appears after an unexpected "security warning."
For organizations
Add the "fake security scan + refund scam" pattern to your security-awareness training for employees — specifically emphasizing that this kind of scam can happen on company computers too.
Block the published domains and IPs (see IOC section) at your enterprise proxy/firewall.
Establish a clear policy: no employee may uninstall security software or install remote-access tools without verifying first with the internal IT department, regardless of any prompt from a website or phone call.
Consider reviewing DNS/proxy logs for connections to "sysscan"-like domains or unusual external IP/geolocation services shortly after visiting an unfamiliar site.
For security teams
Threat hunt using the published IOCs — domains, the hosting IP, and behavioral patterns (the 13–30 score cap, the random "days behind on patches" figure).
Monitor for unusual traffic to the Telegram Bot API from endpoints with no legitimate business need for Telegram.
Watch for new domain variants following similar naming patterns (
*sysscan*,*scanner*combined with major tech brand names) — given the cheap-and-disposable model that drives scammers to register new domains continuously.
