Scareware Campaign Uses Fake Defender Alerts to Target Japan and Germany
Summary
Forcepoint researchers detail an email-driven scareware campaign targeting business users in Japan and Germany, using self-spoofed emails and fake Japanese Defender alerts. They analyze its encrypted payload, browser-locking behavior, and protective measures.
Key points
- Self-spoofed emails with matching sender, envelope sender, and recipient fields direct users to scam pages; Forcepoint reports blocking more than 100,000 campaign emails.
- The pages impersonate Microsoft Defender in Japanese and pressure victims to call a fraudulent technical-support number.
- Researchers found a Base64-encoded payload containing an IV, AES ciphertext, and HMAC-SHA256; the page verifies the HMAC before decrypting the payload with AES-256-CBC.
- The decryption key is stored in the URL fragment and erased from the visible address bar after the alert loads.
- The decrypted script blocks user input, forces fullscreen, plays warning audio, reopens closed tabs, and uses Web Workers to freeze the browser.
- Forcepoint says its protections block the emails and URLs. The article advises closing a stuck browser through Task Manager, not calling displayed support numbers, and scanning the device.
Article Details
- Attack Vectors
- Self-spoofed emails with embedded links redirect recipients to Japanese-language scareware pages.
- The scareware impersonates Microsoft Defender and pressures victims to call a fraudulent technical-support number.
- The page hides its HTML, JavaScript, images, and audio in a Base64-encoded, AES-256-CBC-encrypted payload.
- The page blocks keyboard and browser input, forces fullscreen, repeatedly reopens or reloads tabs, and uses Web Workers running infinite loops to freeze the browser.
- Defensive Notes
- Close the browser using Task Manager if the page cannot be exited.
- Do not call support numbers shown on scareware pages or install software they suggest.
- Clear the browser cache and history, then run an antivirus scan.
- Forcepoint reports blocking the emails and URLs through heuristic detection, web analytics, and real-time scanning signatures.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//barafido[.]z14[.]web[.]core[.]windows[.]net/ | Listed as a campaign scareware URL. |
| URL | hxxps[:]//bipewaga[.]z32[.]web[.]core[.]windows[.]net/ | Listed as a campaign scareware URL. |
| URL | hxxps[:]//bogavunow[.]z22[.]web[.]core[.]windows[.]net/ | Listed as a campaign scareware URL. |
| URL | hxxps[:]//bumalocif[.]z7[.]web[.]core[.]windows[.]net/ | Listed as a campaign URL that redirects victims to the scareware page. |
| URL | hxxps[:]//bumalocif[.]z7[.]web[.]core[.]windows[.]net/uopcv94wr9vp[.]html | Specific campaign page containing the fake Defender alert and scareware payload. |
| URL | hxxps[:]//cezuyibiva[.]z33[.]web[.]core[.]windows[.]net/ | Listed as a campaign scareware URL. |
| URL | hxxps[:]//depudetuz[.]z43[.]web[.]core[.]windows[.]net/ | Listed as a campaign scareware URL. |
| URL | hxxps[:]//diyozinela[.]z13[.]web[.]core[.]windows[.]net/ | Listed as a campaign scareware URL. |
| URL | hxxps[:]//dolivava[.]z4[.]web[.]core[.]windows[.]net/ | Listed as a campaign scareware URL. |
| URL | hxxps[:]//fuvesepiwo[.]z1[.]web[.]core[.]windows[.]net/ | Listed as a campaign scareware URL. |
| URL | hxxps[:]//mubereceg[.]z16[.]web[.]core[.]windows[.]net/ | Listed as a campaign scareware URL. |
| URL | hxxps[:]//nusedaduf[.]z33[.]web[.]core[.]windows[.]net/ | Listed as a campaign scareware URL. |
| URL | hxxps[:]//nusumitetu[.]z23[.]web[.]core[.]windows[.]net/ | Listed as a campaign scareware URL. |
| URL | hxxps[:]//tedepacoc[.]z1[.]web[.]core[.]windows[.]net/ | Listed as a campaign scareware URL. |
| URL | hxxps[:]//teereayi[.]z22[.]web[.]core[.]windows[.]net/ | Listed as a campaign scareware URL. |
| URL | hxxps[:]//tisocadoy[.]z1[.]web[.]core[.]windows[.]net/ | Listed as a campaign scareware URL. |
| URL | hxxps[:]//tuyayafana[.]z31[.]web[.]core[.]windows[.]net/ | Listed as a campaign scareware URL. |
| URL | hxxps[:]//yocadisil[.]z1[.]web[.]core[.]windows[.]net/ | Listed as a campaign scareware URL. |
| URL | hxxps[:]//yubofanow[.]z27[.]web[.]core[.]windows[.]net/ | Listed as a campaign scareware URL. |
| URL | hxxps[:]//zizozemeca[.]z31[.]web[.]core[.]windows[.]net/ | Listed as a campaign scareware URL. |
| URL | hxxps[:]//zosewayeri[.]z38[.]web[.]core[.]windows[.]net/ | Listed as a campaign scareware URL. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe page conceals its payload in a Base64-encoded blob and decrypts AES-256-CBC-encrypted content in the browser.T1204.001 · Malicious LinkVictims are directed to click an embedded link that leads to the scareware page.T1499.002 · Service Exhaustion FloodThe page spawns multiple Web Workers running infinite loops, which the article reports freeze the browser.T1566.002 · Spearphishing LinkThe campaign sends deceptive emails containing links to scareware pages.T1656 · ImpersonationThe scareware impersonates Microsoft Defender with a fake security alert to pressure victims into calling fraudulent support.
People
Products
Tools
Countries
GermanyForcepoint is currently blocking 100,000+ such emails, indicating this is a high‑volume, ongoing spam run actively targeting business sectors in Japan and Germany.JapanURL. The sender IPs originate from multiple unrelated global regions, with targeting highly focused on Japan and German users in business sectors.