# Large-Scale Azure-Hosted Tech Support Scam Campaign Targets Japan (13.38M Emails, 240K+ Relay IPs, 33K+ Disposable Azure Blob Storage Sites)

> Between mid-December 2025 and May 2026, a sustained tech support scam campaign sent 13.38 million emails (94% to .jp addresses) via 240,000+ globally distributed sending/relaying IP addresses, driving victims to 33,000+ disposable fake security-alert pages hosted on Microsoft Azure Blob Storage static website hosting. Victims who call the displayed North American (+1) support numbers are talked into installing legitimate remote-access software (AnyDesk, TeamViewer, RustDesk, ScreenConnect, UltraViewer, LogMeIn), leading to credential theft and fraudulent banking transactions.

- **Published:** 2026-09-21T00:00:00Z
- **Last reviewed:** 2026-09-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2595
- **ID:** TL-2026-2595
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Trend Micro tracked a 165-day tech support scam operation that sent 13.38 million emails at an average of ~81,000/day, peaking at 4.45 million emails (~160,000/day) in February 2026 and settling to a sustained ~30,000/day by May 2026. Ninety-four percent of targeted addresses used Japan's .jp top-level domain, and delivery timing was tuned to Japan Standard Time business hours (09:00-21:00 JST).

Delivery infrastructure comprised more than 240,000 sending/relaying IP addresses distributed globally (Brazil contributed the largest email volume; China the most unique source IPs). A subset of this infrastructure fingerprinted as legitimate, internet-exposed network devices rather than dedicated attacker infrastructure: 3,231 relaying IPs ran MikroTik services, of which 2,657 exposed MikroTik's TCP/2000 (bandwidth-test) service to the internet, alongside 284 exposing OpenSSH, 184 exposing nginx, and 144 exposing Apache. This fingerprint is consistent with hijacked/unmanaged IoT and small-office router equipment being recruited as spam relays, a pattern independently documented in unrelated 2025 MikroTik-botnet malspam reporting.

Landing infrastructure used Microsoft Azure Blob Storage's static website hosting feature to serve more than 33,000 disposable fake security-alert pages; roughly 90% were used for only a single day before rotation, and page content was encrypted to evade content-based scanners. Abuse of Azure Blob Storage's trusted, Microsoft-issued-TLS static hosting for phishing/scam landing pages mirrors broader 2025-2026 industry reporting on cloud-native phishing infrastructure abuse.

The campaign's lures evolved in two phases. From mid-December 2025 through March 2026, lures were generic: fake security warnings, adult-content pretexts, and impersonation of e-commerce platforms, financial institutions, and tax agencies. From April 2026 onward, the operators shifted to workplace-themed social engineering aimed at individuals inside organizations, with subject lines such as "[Urgent] Internal network security audit: Request to verify suspicious device activity and logs," "[Confidential] Advance release of the H2 FY2026 performance evaluations and promotion candidate list," "[Important / All employees] Confirmation of H2 FY2026 salary revisions and evaluation feedback," "[Employee benefits] Notice: Digital Amazon gift cards for all employees," "[Important notice] Changes to commuting expense reimbursement rules," and "[Urgent] Request for confirmation regarding flat-rate tax cut and refund procedures." More than 90% of sender addresses were spoofed to match the recipient's own address, a technique intended to defeat casual sender-legitimacy checks and increase open rates.

The monetization chain is classic callback phishing / Telephone-Oriented Attack Delivery (TOAD): the email or landing page displays a support phone number; the victim calls it; a live operator instructs the victim to install a remote-access tool (AnyDesk, TeamViewer, RustDesk, ScreenConnect, UltraViewer, or LogMeIn); the operator then uses that access to harvest credentials, navigate the victim into their online banking portal, and extract fraudulent fees or transfers. Trend Micro identified 11-12 distinct callback phone numbers reused across 4,721 of the fake alert sites (February-May 2026 data, current as of June 12, 2026); the numbers use Japan's "010" international access prefix followed by North American (+1) numbers, indicating a North America-based call operation servicing Japanese victims.

Japan's National Police Agency's 2025 fraud statistics show "support-pretext" billing fraud (the category corresponding to tech support scams) at 1,048 reported cases (down 31.2% year-over-year) but 1.49 billion yen in losses (up 48.1% year-over-year) -- meaning far fewer victims are being defrauded, but for roughly double the average amount per case, consistent with the campaign's April 2026 pivot toward higher-value enterprise/workplace targets.

No threat-actor attribution is offered in available reporting. This campaign is a distinct operation from, but part of the same broader tech-support-scam ecosystem as, Barracuda's May 2026 "CypherLoc" browser-locking scareware kit report; the two should not be conflated as the same infrastructure or toolset absent further evidence.

## MITRE ATT&CK

- T1589.002 Email Addresses
- T1598.003 Spearphishing Link
- T1583.006 Web Services
- T1584.005 Botnet
- T1566.002 Spearphishing Link
- T1566.004 Spearphishing Voice
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1684.001 Impersonation
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1219 Remote Access Tools
- T1657 Financial Theft

## Sources

- [13M+ Emails Sent in Tech Support Scam Targeting Users, Organizations in Japan](https://www.trendmicro.com/en_us/research/26/g/tech-support-scams-targeting-japan.html)
- [Inside the attack chain: Threat activity targeting Azure Blob Storage](https://www.microsoft.com/en-us/security/blog/2025/10/20/inside-the-attack-chain-threat-activity-targeting-azure-blob-storage/)
- [13,000 MikroTik Routers Hijacked by Botnet for Malspam and Cyberattacks](https://thehackernews.com/2025/01/13000-mikrotik-routers-hijacked-by.html)
- [Threat Spotlight: CypherLoc, an advanced browser-locking scareware targeting millions](https://blog.barracuda.com/2026/05/20/threat-spotlight-cypherloc-scareware)
- [Fraud soars to record high in Japan as scam tactics grow more sophisticated](https://www.japantimes.co.jp/news/2026/02/12/japan/crime-legal/japan-2025-crime-figures/)
- [Fake Police Scams Double in Japan as Financial Losses from Fraud Soar](https://www.nippon.com/en/japan-data/h02795/fake-police-scams-double-in-japan-as-financial-losses-from-fraud-soar.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2595