Fake Microsoft Security Scan Tells You to Uninstall Your Antivirus — Here's the SOC Analyst Breakdown
Picture this: a user on your network calls the help desk in a panic. A Microsoft-branded page told them their antivirus was "causing critical system failures" and that Windows "no longer supports third-party antivirus." They followed the instructions. They uninstalled their AV. Now they're on the phone with someone claiming to be a "refund manager," and that person wants remote access to "fix the problem."
This isn't a hypothetical. It's happening right now, and it's the exact playbook uncovered by Malwarebytes researchers in a wave of scam sites branded "SysScan." If you work in a SOC, run IT for a small business, or just want to keep your family's laptops safe, this one is worth understanding in detail — because the trick isn't malware. It's psychology wrapped in a fake progress bar.
Table of Contents
- What Actually Happened
- How the Scam Works, Step by Step
- Why the "Security Scan" Feels Real (But Isn't)
- The Refund Call and the Remote Access Trap
- Indicators of Compromise (IOCs)
- Detection and Defense Strategies
- What to Do If You Already Fell for It
- Expert Tips for SOC Teams and IT Admins
- FAQ
- Conclusion
What Actually Happened
Malwarebytes ThreatLabs identified 11 related scam websites hosted on a single server, all using near-identical branding under the name "SysScan." Each site presents itself as a Microsoft-linked security check. Domains include variations like detectsysscanner[.]com, techsysscanner[.]lol, and tlcscanner[.]com — different names, same infrastructure, same script.
The sites claim to run a full device security scan directly from the browser. They report fabricated failures in areas like browser isolation, firmware security, memory protection, and Windows patch status. Then they deliver the punchline: your third-party antivirus is the cause of these "failures," and it must be uninstalled immediately.
That claim is false. A browser cannot inspect firmware settings, memory integrity, or antivirus engine health. It has no access to that layer of the operating system. But the scam doesn't need to be technically accurate — it only needs to be convincing enough to trigger panic.
How the Scam Works, Step by Step
Unlike traditional tech support scams that rely on a malicious download or a scary browser lock screen, this campaign is built entirely around social engineering and data harvesting. No exploit is required at the technical level — the entire attack chain runs on trust manipulation.
- Landing page: Victim arrives via malvertising, SEO poisoning, or a redirect chain, and lands on a SysScan-branded page.
- Fake scan animation: A convincing progress bar runs, referencing real but harmless browser-exposed data (OS version, screen resolution, processor count).
- Rigged score: The scan always returns a score between 13 and 30 out of 100 — deliberately low, so no visitor ever passes.
- Antivirus uninstall demand: The page insists the installed antivirus is the root cause and must be removed. It presents a dropdown listing 28 named antivirus products (plus "Other" and several enterprise security tools).
- Refund/support form: Victim is pushed to a form requesting name, address, phone number, email, bank name, claimed refund amount, cryptocurrency username, and remote-access session credentials.
- Data exfiltration: Form submissions are sent directly to a Telegram bot API — no backend server, no hosting cost, easy to spin up and abandon.
- Fake callback: Victim is redirected to a "your refund manager will call in 3–5 minutes" page, complete with a looping stock office video to build false legitimacy.
Why the "Security Scan" Feels Real (But Isn't)
This is the part that trips up even reasonably cautious users. The scam blends two ingredients: genuine browser telemetry and completely invented conclusions.
Browsers legitimately expose details like operating system, screen dimensions, processor thread count, and certain permission states through standard web APIs. The SysScan pages pull this real data and display it alongside fixed, hard-coded "findings" that have nothing to do with the visitor's actual system health.
Researchers confirmed that most of the reported problems are static — baked into the page code rather than generated by any real assessment. Every visitor, regardless of device or security posture, receives a bad result. That's the giveaway: a legitimate scan produces variable results based on real system state. A rigged scan produces the same manufactured outcome every time.
There's also a kernel of truth the scam distorts to sound credible. Windows does place Microsoft Defender Antivirus into a passive state when a compatible third-party antivirus is installed — this is normal, documented behavior, not evidence that Windows "no longer supports" other antivirus products.
The Refund Call and the Remote Access Trap
The endgame isn't the fake scan itself — it's what comes after. The data collection form is unusually thorough for a scam of this type, and that detail matters for SOC analysts assessing severity.
Fields captured include personal identity information, banking details, claimed refund amounts, cryptocurrency usernames, and a selector for one of 30 different remote-access tools. The form even includes fields for an "agent ID," agent name, and company — strongly suggesting a live operator walks the victim through the process by phone, reinforcing urgency and trust in real time.
By the time a scammer requests remote access, the victim has already been primed through three trust-building steps: a branded "official-looking" scan, a form that feels like standard customer service intake, and a promised callback. Removing the antivirus beforehand isn't incidental — it clears the one thing that might interfere with whatever the scammer installs or does once remote access is granted.
Indicators of Compromise (IOCs)
| Type | Indicator | Description |
|---|---|---|
| IP Address | 157.230.180.90 | Hosting server associated with the scam sites |
| Domain | detectsysscanner[.]at | Scam site domain |
| Domain | detectsysscanner[.]com | Scam site domain |
| Domain | detectsysscanner[.]de | Scam site domain |
| Domain | detectsysscanner[.]in[.]net | Scam site domain |
| Domain | detsysscanner[.]com | Scam site domain |
| Domain | detsysscanner[.]de | Scam site domain |
| Domain | techsysscanner[.]com | Scam site domain |
| Domain | techsysscanner[.]lol | Scam site domain |
| Domain | tlcscanner[.]com | Scam site domain |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detection and Defense Strategies
From a SOC and endpoint defense standpoint, this campaign is more about user awareness than signature-based detection — but there are still concrete controls worth implementing.
- DNS filtering: Block newly registered lookalike domains and known scam infrastructure at the resolver level using threat intel feeds.
- Browser policy hardening: Restrict full-screen mode triggers and pop-up permissions via group policy or endpoint management to reduce the visual pressure these pages rely on.
- Antivirus uninstall alerting: Configure your EDR/AV management console to alert immediately if protection is disabled or uninstalled outside of a change-management window.
- Remote access tool allow-listing: Block unauthorized remote-access software (TeamViewer, AnyDesk, UltraViewer, and similar) from installing unless approved by IT.
- User awareness training: Teach staff that Microsoft never initiates security "scans" through a random webpage, and never requires uninstalling protective software as a condition for support or a refund.
- Web proxy / SWG rules: Flag pages that combine urgency language ("critical," "immediate action required") with forms requesting banking or remote-access credentials.
For teams building detection logic, treat "AV disabled outside change window" + "new remote access tool installed within the hour" as a correlated high-priority alert. That sequence closely mirrors both this scam and legitimate tech support fraud more broadly.
What to Do If You Already Fell for It
If someone has already followed these instructions, speed matters more than perfection. Work through this sequence calmly:
- Disconnect the device from the internet immediately (unplug Ethernet or disable Wi-Fi).
- Uninstall any remote-access tool the scammer had you install or use.
- Reinstall your antivirus software and update it to the latest definitions.
- Run a full system scan, not a quick scan.
- If banking details or online banking access was shared, call your bank immediately using a number found independently — never one given during the scam call.
- Change your email and banking passwords from a separate, trusted device.
- Report the incident — in the US, file with the FBI's IC3; consumers can also report to the FTC.
Don't let embarrassment slow this down. The faster the response, the smaller the financial and account-compromise blast radius.
Expert Tips for SOC Teams and IT Admins
- Add "AV removed + remote access tool installed" as a correlated SIEM alert rule — this pairing is a strong fraud indicator, not just a policy violation.
- Periodically test your organization's web filtering against known tech-support-scam domain patterns (typosquats, "scanner," "detect," "fix" prefixed domains are common).
- Brief non-technical staff and family members the same way you'd brief a junior analyst: real security tools don't threaten you into removing protection.
- Keep an internal "scam of the month" briefing — campaigns like SysScan evolve fast, and static training material goes stale within weeks.
Related Cybersecurity Topics You Should Explore
- 768 Leaked AWS Keys Still Have Full Admin Access in 2026
- Enable Maximum Windows Logging for SOC & Ransomware Detection
- OpenBin.ai & OpenAPK.ai Review: Free AI Reverse Engineering Tool
- Grok Zero-Click Hack Steals Your Chats — No Click Needed
- head Command in Linux: Fast Log Triage for SOC Analysts
- Elementor Pro Bug Lets Hackers Upload PHP — No Login Needed
- tac Command Tutorial: Reverse Logs Fast for Faster Threat Detection
- ToxicPanda 2.0: The Android Trojan Now Hacking 349 Banks
- Windows 11 24H2 Support Ends Oct 13 — Are You at Risk?
- Cat Command in Linux: The SOC Analyst's Secret Weapon
- How a Fake VNC Login Turned Into Full Root Access on macOS
- reconFTW Tutorial: The Recon Tool That Found My Hidden Bounty
- TP-Link Router Flaw Lets Hackers Skip Login Entirely — Here's What's at Risk
- This subfinder Fork Cuts Recon Time in Half — subfaster Review
- 737 Fake VPN Extensions Are Spying on Chrome Users Right Now
- GhostDesk Spyware Alert: Fake CCleaner Steals Passwords & Crypto
- Zoomsday Flaw: Hackers Hijack Zoom Users With Zero Clicks
Frequently Asked Questions
Is this scam linked to real Microsoft infrastructure in any way?
No. The sites use Microsoft branding and terminology without any actual connection to Microsoft. Microsoft does not run security scans through third-party webpages.
Can a website really scan my antivirus status?
No. A browser can read limited, surface-level information like screen size and OS version, but it cannot inspect antivirus engine status, firmware settings, or memory integrity. Any page claiming to do a full "security scan" from the browser alone is not being honest about its capabilities.
Why does uninstalling antivirus matter so much to the scammers?
Removing your antivirus clears a potential obstacle to whatever software or access the scammer wants to use next, including remote-access tools, while also revealing which specific product you were using.
What is Telegram's role in this scam?
Submitted form data is routed directly to a Telegram bot API. This lets scammers run the operation without maintaining their own backend server, keeping the infrastructure cheap and disposable.
Is Microsoft Defender being disabled a sign of compromise?
Not by itself. Windows normally moves Defender into a passive state when a compatible third-party antivirus is active — that's expected behavior, not a problem. It only becomes a concern if the third-party AV was also removed and nothing replaced it.
How can I tell a real Microsoft alert from a fake one?
Genuine Microsoft security notifications never appear as a random webpage with a phone number to call, never demand you uninstall software, and never pressure you with a countdown or fake "refund manager" callback.
Conclusion
The SysScan campaign isn't technically sophisticated — no exploit, no zero-day, no custom malware. It doesn't need to be. It succeeds by exploiting trust in a familiar brand and manufacturing urgency around a fabricated problem. For defenders, the lesson is straightforward: the biggest attack surface here isn't a vulnerable endpoint, it's a user under pressure with a countdown clock and a scary red "13/100" score on their screen.
If this breakdown helped you understand the attack chain, share it with someone who might click first and think later — that's usually who these scams are built for. Got a similar incident you've handled? Drop it in the comments; real-world war stories are what make this community sharper.