Tech Support Scam Campaign Sent 13 Million Emails to Japanese Addresses
Summary
Trend Micro analyzed a 165-day tech-support scam campaign that sent 13.38 million emails, mostly to .jp addresses, linking recipients to rapidly rotated fake alert sites and scam call centers; workplace-themed lures appeared in May.
Key points
- From mid-December 2025 through May 2026, the campaign sent about 13.38 million emails from or through more than 240,000 IP addresses; 94% targeted .jp addresses. Delivery continued in May at about 30,000 emails per day.
- Emails led to more than 33,000 rapidly rotated fake security-alert sites. The pages urged victims to call scam support lines, where scammers could seek fraudulent fees or use remote access to facilitate financial theft.
- More than 90% of sender addresses were spoofed. Lures included fake security warnings, impersonation of organizations, and, from May, workplace-themed notices such as performance reviews and salary revisions.
- Researchers found signs that IoT devices and other systems may have been abused for email delivery; among the top 10,000 sending IPs examined, 3,231 had services that appeared to run on MikroTik devices.
- The fake alert sites used Microsoft Azure Blob Storage, and roughly 90% were linked in emails for only one day. Researchers also found 11 scam phone numbers reused across 4,721 sites.
- Recommended defenses include enforcing SPF, DKIM, and DMARC; filtering suspicious email and links; restricting unauthorized remote-access software; monitoring international calls; and training employees to recognize scams.
Article Details
- Attack Vectors
- High-volume emails lure recipients to fake security alert websites, then direct them to fraudulent support call centers.
- More than 90% of sender addresses were spoofed to match recipients' addresses or legitimate service addresses, including addresses actually used by impersonated organizations.
- Lures include fabricated security warnings, adult content, organization impersonation, and workplace notices about performance reviews, salary revisions, audits, and internal procedures. Workplace-themed messages appeared in May 2026, suggesting possible expansion toward organizational accounts.
- Fake alert sites use static website hosting on cloud storage, content encryption, and rapid replacement to evade detection and analysis. Roughly 90% were observed in email links for only one day.
- Scammers pose as support staff and remotely control victims' devices. In confirmed organizational cases, victims were directed to access online banking while their devices were remotely controlled, resulting in financial losses.
- Globally distributed email delivery infrastructure may include hijacked IoT devices. The researchers presented device compromise as a likely explanation, not a confirmed finding.
- Defensive Notes
- Avoid links and phone numbers in unsolicited messages; verify alerts through official websites opened from trusted bookmarks or through established support contacts.
- Close fake warning pages or terminate the browser through Task Manager if necessary. Learn how to exit full-screen mode, including using Esc or Ctrl + Alt + Del.
- Enforce SPF, DKIM, and DMARC to help detect sender-address spoofing.
- Use layered email gateway inspection of message bodies, attachments, and URLs, and continuously update brand-impersonation and phishing filters.
- Block malicious emails and websites, and use protections that warn about or block known scam phone numbers.
- Restrict unnecessary remote-access software through application control and monitor its use with XDR. Certificate-based application controls can suppress specified remote-access applications.
- Restrict or flag outbound international calls through PBX or similar telephone systems to interrupt contact with scam call centers.
- Conduct employee education and phishing drills, establish trusted reporting channels, and encourage reporting without blame.
- Following an incident, promptly contact police, a consumer affairs center, or the relevant financial institution.
- Email filtering can consider domain creation recency, how rarely a URL has been observed, and whether the message body is written in Japanese.
- The article states that abuse of the legitimate products and services discussed does not indicate vulnerabilities or security flaws in them.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationFake security alert sites employ content encryption to evade analysis.T1219 · Remote Access ToolsScammers remotely control victims' devices while posing as support staff; the article identifies legitimate remote-access software abused in tech support scams.T1566.002 · Spearphishing LinkScam emails contain links that lead recipients to fake security alert websites and fraudulent support phone numbers.T1583.006 · Web ServicesThreat actors build disposable fake alert sites using Microsoft Azure Blob Storage static website hosting, publishing HTML/JS over HTTPS and rapidly replacing sites.T1656 · ImpersonationScammers impersonate legitimate organizations, internal administrators, and technical support staff; more than 90% of observed sender addresses were spoofed.
People
Vendors
MicrosoftThe fake alert sites are built on the static website hosting feature of Microsoft Azure Blob Storage.MikroTikOf these, 3,231 IP addresses were running services that appear to operate on MikroTik devices, and on 2,657 of those IP addresses, TCP port 2000 was reachable from the internet.Trend Micro
Products
Microsoft Azure Blob StorageThe fake alert sites are built on the static website hosting feature of Microsoft Azure Blob Storage.Microsoft WindowsFor example, in 2023, we detected and blocked more than 9 million visits to Japanese-language tech support scam sites among Windows users, a scale indicating that roughly 10% encountered such site in some form.TrendAI Vision One™ Email and Collaboration SecurityOn the email side, the correlated intelligence capability of TrendAI Vision One™ Email and Collaboration Security can reduce the inflow of malicious email through rules that weigh multiple conditions, such as howTrendAI Vision One™ Endpoint SecurityTo restrain application execution, the application control capability of TrendAI Vision One™ Endpoint Security can suppress specific remote-access software by specifying the certificates that legitimate remote-accessTrendLife Maximum SecurityTrendLife Maximum Security blocks scam emails with its anti-scam email protection and blocks access to malicious websites with its web threat protection.TrendLife ScamCheckTrendLife ScamCheck, an anti-scam mobile app, combines AI technologies to protect users from increasingly sophisticated scam threats.
Tools
AnyDeskThreat actors abuse legitimate remote-access software such as LogMeIn, UltraViewer, ScreenConnect, RustDesk, AnyDesk, and TeamViewer.LogMeInThreat actors abuse legitimate remote-access software such as LogMeIn, UltraViewer, ScreenConnect, RustDesk, AnyDesk, and TeamViewer.RustDeskThreat actors abuse legitimate remote-access software such as LogMeIn, UltraViewer, ScreenConnect, RustDesk, AnyDesk, and TeamViewer.ScreenConnectThreat actors abuse legitimate remote-access software such as LogMeIn, UltraViewer, ScreenConnect, RustDesk, AnyDesk, and TeamViewer.ShodanWe analyzed the top 10,000 sending IP addresses by send-event count against the information recorded in Shodan, a search engine for internet-connected systems and services.TeamViewerThreat actors abuse legitimate remote-access software such as LogMeIn, UltraViewer, ScreenConnect, RustDesk, AnyDesk, and TeamViewer.UltraViewerThreat actors abuse legitimate remote-access software such as LogMeIn, UltraViewer, ScreenConnect, RustDesk, AnyDesk, and TeamViewer.
Countries
BrazilBrazil accounted for the largest email volume, while China had the largest number of unique sending/relaying IP addresses.ChinaBrazil accounted for the largest email volume, while China had the largest number of unique sending/relaying IP addresses.Japan13M+ Emails Sent in Tech Support Scam Targeting Users, Organizations in Japan