Large-Scale Tech Support Scam Email Campaign Targeting Users and Organizations in Japan (13M+ Emails)

Key facts

Detection coverage

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5543 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TL-2026-5543 Tech Support Scam Alert Page on Azure Static Website Hosting (web.core.windows.net) - Exploitation

Detects web proxy requests to randomly named Azure Blob Storage static website hosts (random label, optional zNN shard, web.core.windows.net) used for the disposable fake security alert pages in the Japan tech support scam email campaign (TL-2026-5543). The pages use fragment-keyed encrypted JavaScript payloads (T1027.013, T1059.007, T1480.001) and are reached by users clicking emailed links (T1566.002, T1204.001). The parent domain is a legitimate Microsoft service, so the logic keys on the random-label host pattern and an optional mail-client referrer rather than blocking the domain.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566.002, T1204.001, T1583.006, T1059.007, T1027.013, T1480.001
• Data sources: zscaler_nss_web_proxy (index=proxy, sourcetype=zscalernss-web), microsoft_defender_for_endpoint (DeviceNetworkEvents), web_proxy_logs
• Severity: medium
• Confidence: medium

Splunk SPL

index=proxy earliest=-24h sourcetype="zscalernss-web" action=Allowed "web.core.windows.net"
| eval dest_url=lower(coalesce(url, requested_url)), referrer=lower(coalesce(http_referrer, referer, ""))
| eval site_host=mvindex(split(replace(dest_url, "^https?://", ""), "/"), 0)
| where match(site_host, "[.]web[.]core[.]windows[.]net$")
| eval random_label=if(match(site_host, "^[a-z0-9]{5,20}([.]z[0-9]{1,3})?[.]web[.]core[.]windows[.]net$"), 1, 0)
| eval mail_referrer=if(match(referrer, "(mail[.]|outlook|safelinks|webmail)"), 1, 0)
| stats count min(_time) as first_seen max(_time) as last_seen values(site_host) as site_hosts values(dest_url) as urls max(mail_referrer) as mail_referrer max(random_label) as random_label by user, src
| where random_label=1
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen user src site_hosts urls mail_referrer count

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has 'web.core.windows.net'
| where InitiatingProcessFileName in~ ('chrome.exe', 'msedge.exe', 'firefox.exe', 'iexplore.exe', 'brave.exe')
| extend SiteHost = tolower(tostring(parse_url(iff(RemoteUrl startswith 'http', RemoteUrl, strcat('https://', RemoteUrl))).Host))
| where SiteHost matches regex @'^[a-z0-9]{5,20}([.]z[0-9]{1,3})?[.]web[.]core[.]windows[.]net$'
| summarize Visits = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Urls = make_set(RemoteUrl, 10) by DeviceName, InitiatingProcessAccountName, SiteHost
| project FirstSeen, LastSeen, DeviceName, InitiatingProcessAccountName, SiteHost, Urls, Visits

Sigma

title: TL-2026-5543 Tech Support Scam Alert Site on Azure Static Website Hosting
id: 7c1d4e2a-3b58-4f0e-a6d9-1e2b9c5f8a01
status: experimental
description: Detects web proxy requests to randomly named Azure Blob Storage static website hosts (random label, optional zNN shard, web.core.windows.net) used for disposable fake security alert pages in the Japan tech support scam campaign TL-2026-5543.
references:
    - https://www.trendmicro.com/en_us/research/26/g/tech-support-scams-targeting-japan.html
    - https://www.forcepoint.com/ko/blog/x-labs/scareware-campaign-targets-japan-germany
author: Threadlinqs Team
date: 2026-11-09
tags:
    - attack.initial-access
    - attack.t1566.002
    - attack.execution
    - attack.t1204.001
    - attack.t1059.007
    - attack.resource-development
    - attack.t1583.006
    - attack.defense-evasion
    - attack.t1027.013
    - attack.t1480.001
logsource:
    category: proxy
detection:
    selection:
        cs-method: 'GET'
        cs-host|re: '^[a-z0-9]{5,20}([.]z[0-9]{1,3})?[.]web[.]core[.]windows[.]net$'
    condition: selection
falsepositives:
    - Legitimate static websites hosted by organizations on Azure Blob Storage
    - Developer and QA preview sites
level: medium

Known false positives:

• Legitimate organization-owned static sites hosted on Azure Blob Storage static website hosting
• Developer or QA preview sites on randomly named storage accounts

Tuning notes: Allowlist storage accounts your organization owns (match site_host against an asset lookup). Adjust the sourcetype and field names (url, http_referrer) to your proxy (Palo Alto, Bluecoat, Netskope). Raise priority when mail_referrer=1 or the host is first-seen in the last 7 days; the alert pages live about one day so alert quickly. Do not block web.core.windows.net wholesale.

• 🔒 TL-2026-5543 Spoofed Inbound Email Addressed From the Recipient's Own Address or Linking to Azure Static Sites - Exploitation · unlock with TL Creds
• 🔒 TL-2026-5543 Remote Access Tool Installed as a Windows Service - Post-Exploitation · unlock with TL Creds
• 🔒 TL-2026-5543 Remote Access Tool Establishing Outbound Sessions to Public Relays - C2 · unlock with TL Creds
• 🔒 TL-2026-5543 Inbound TCP/2000 to Internet-Exposed MikroTik Device - Exploitation (Relay Infrastructure) · unlock with TL Creds
• 🔒 TL-2026-5543 Silent or Unattended Remote Access Tool Install with Password or Service Flags - Post-Exploitation · unlock with TL Creds
• 🔒 TL-2026-5543 DNS Resolution of Remote Access Tool Relay Domains - C2 · unlock with TL Creds
• 🔒 TL-2026-5543 Remote Access Tool Launched from Browser or User-Writable Path (AnyDesk, TeamViewer, ScreenConnect, RustDesk, UltraViewer, LogMeIn) - Post-Exploitation · unlock with TL Creds
• 🔒 TL-2026-5543 Outbound Call to Known Tech Support Scam Phone Number - C2 / Impact · unlock with TL Creds

Indicators of compromise

As of 2026-11-09, Threadlinqs Intelligence tracks 24 indicators of compromise for TL-2026-5543.

Sample indicators (1 of 24)

• Domain: web[.]core[.]windows[.]net

Defanged, TLP:CLEAR. Full set of 24 indicators: unlock with TL Creds.

Technical analysis

Trend Micro Research (published 2026-07-23) documents a high-volume tech support scam (TSS) campaign that shifted from mostly malvertising to mass email distribution starting mid-December 2025. Over 165 days Trend Micro observed roughly 13.38 million emails (about 81,000/day average), peaking at about 4.45 million in February 2026 (about 160,000/day) and falling to about 30,000/day by May 2026. About 94% were addressed to .jp domains. More than 33,000 disposable fake security alert sites were used, about 90% of them linked from emails for only a single day.

Email delivery: more than 90% of sender addresses were spoofed, either to match the recipient's own address or to impersonate legitimate services and organizations (their real sending addresses were forged). Emails were sent or relayed from more than 240,000 IP addresses worldwide; Brazil had the highest volume and China the most unique IPs. Header timestamp offsets suggest hijacked IoT devices and similar equipment. A Shodan review of the top 10,000 sending IPs found 3,231 hosts running services that appear to be MikroTik devices, 2,657 of which had TCP port 2000 reachable from the internet; other services were OpenSSH (284), nginx (184) and Apache (144), while 5,940 had no confirmed service. Lures started with fake warnings and adult/explicit content, added impersonation of e-commerce, transport and financial institutions, the National Tax Agency and job listings in mid-April 2026, and from May 2026 targeted individuals inside organizations with workplace themes (internal security audits, performance evaluations, salary revisions, promotion lists, commuting expense rules, compliance complaints, emergency contact re-registration, system maintenance login tests, tax refund procedures), often with fake HR system IDs and confidential/urgent framing.

Landing sites and scam mechanics: the fake alert pages were hosted on Microsoft Azure Blob Storage static website hosting over HTTPS, with encrypted content to hinder analysis. Related reporting from Forcepoint X-Labs (2026-03-11) on a similar Japan/Germany scareware run describes randomized *.web.core.windows.net subdomains, an AES-256 encrypted payload gated by an HMAC-SHA256 check with the key held in the URL fragment, forced full-screen mode, blocked keyboard/right-click/DevTools, an auto-playing Japanese audio warning, anti-exit tab reloads and Web Worker freeze loops, and a Japanese Microsoft Defender lookalike alert. Barracuda (2026-05-20) describes the similar CypherLoc scareware kit (fragment-keyed AES payload, HMAC-SHA256 integrity check, (0,eval) execution, history.replaceState fragment removal, DevTools-triggered anti-analysis, victim public IP display). Trend Micro notes Barracuda's sites share a similar structure; it does not state that the campaigns are identical.

Monetization: the victim calls a number shown on the page; the scammer poses as tech support, persuades the victim to install remote access software (LogMeIn, UltraViewer, ScreenConnect, RustDesk, AnyDesk, TeamViewer are named as commonly abused), and pushes the victim to pay support fees or wire money. In confirmed organizational cases the victim was directed to log in to online banking while the scammer controlled the device. Between 2026-02-26 and 2026-05-31, 4,721 alert sites displayed only 11 distinct phone numbers, all international (mainly North American); numbers persist for a week or more even though sites last about a day. Trend Micro's IoC list holds 12 numbers as of 2026-06-12. No attribution is stated. Japan's National Police Agency reported 1,048 support-pretext billing fraud cases in 2025 (down 31.2%) with about 1.49 billion yen in losses (up 48.1%).

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027.013 Encrypted/Encoded File; T1480.001 Environmental Keying; T1684.001 Impersonation

Execution

T1059.007 JavaScript; T1204.001 Malicious Link

Command and Control

T1219.002 Remote Desktop Software

Initial Access

T1566.002 Spearphishing Link

Resource Development

T1583.006 Web Services; T1584.008 Network Devices

Impact

T1657 Financial Theft

Remediation

Immediate actions

• Block the 12 published scam phone numbers at the PBX/SBC and flag or restrict outbound international calls
• Block or alert on web.core.windows.net static-website URLs reached from inbound email links, especially newly seen or rare hostnames
• Search mail logs for messages where From, envelope sender and recipient are identical or where the From domain fails SPF/DKIM/DMARC alignment
• Alert on install or launch of remote access tools (LogMeIn, UltraViewer, ScreenConnect, RustDesk, AnyDesk, TeamViewer) not approved by IT

Workarounds

• Never call numbers shown on warning screens or in emails; reach vendors through bookmarked official sites
• Close the browser or end the process in Task Manager instead of interacting with the alert page

Longer-term hardening

• Enforce SPF, DKIM and DMARC (reject policy) on owned domains and on inbound mail
• Layer email gateway inspection of bodies, attachments and URLs, including URL domain age/rarity and Japanese-language brand-impersonation and phishing rules
• Restrict and monitor remote access software via application control and XDR
• Run regular employee education and phishing drills and build a culture of reporting; teach users to exit full-screen (long-press Esc, Ctrl+Alt+Del) and end the browser via Task Manager
• Harden internet-exposed MikroTik/IoT devices (disable unneeded services such as TCP/2000 bandwidth-test, patch firmware) to avoid becoming relay infrastructure

Affected and fixed versions

• Various — Email recipients and Windows/web browser users in Japan (individuals and employees of organizations)
  Vulnerable versions: Not version-specific; social-engineering campaign
• Microsoft — Azure Blob Storage static website hosting (abused as hosting platform)
  Vulnerable versions: Service abuse; not a product vulnerability
• MikroTik — RouterOS devices (likely abused as email relay/sending infrastructure)
  Vulnerable versions: Not specified in source

Timeline

• 2025-12-15 Trend Micro observation window begins (mid-December 2025); operators shift from mostly malvertising to large-scale email distribution of tech support scam lures.
• 2026-01-15 During January 2026 fake alert sites are created at 400 to 1,000 per day, nearly every day (mid-month date approximates 'January 2026').
• 2026-02-15 Email volume peaks in February 2026 at about 4.45 million messages (about 160,000/day); date approximates 'February 2026'.
• 2026-02-26 Trend Micro begins collecting scam phone numbers displayed on fake alert sites.
• 2026-03-11 Forcepoint X-Labs publishes analysis of a similar spoofed-sender scareware campaign hosted on *.locked-ioc-3 targeting business users in Japan and Germany.
• 2026-04-15 Mid-April 2026: impersonation emails appear (e-commerce, transport, financial institutions, National Tax Agency, job listings).
• 2026-05-15 May 2026: emails aimed at individuals inside organizations (performance reviews, salary revisions, HR themes) appear; volume about 30,000/day. Date approximates 'May 2026'.
• 2026-05-20 Barracuda publishes CypherLoc scareware analysis (about 2.8 million attacks since start of 2026), describing similarly structured sites.
• 2026-05-31 End of Trend Micro's phone number tracking window: 4,721 alert sites showed only 11 distinct numbers.
• 2026-06-12 Date of Trend Micro's published list of 12 scam phone numbers.
• 2026-07-23 Trend Micro publishes 'tech support scams targeting Japan' reporting 13.38 million emails over 165 days.

Sources cited

• Japan National Police Agency - Special fraud statistics 2025 (hurikomesagi_toukei2025) npa.go.jp · Advisory · 2026-05-22
• 13M+ Emails Sent in Tech Support Scam Targeting Users, Organizations in Japan (Trend Micro Research) Trend Micro · Research · 2026-07-23
• Scareware Campaign Targets Japan and Germany (Forcepoint X-Labs) forcepoint.com · Research · 2026-03-11
• Trend Micro press release: tech support scams as major consumer threat in Japan Trend Micro · Vendor report · 2024-04-25
• Trend Micro Japan: fake emails tech support scam (earlier Japanese-language report) Trend Micro · Research · 2026-07-23
• Threat Spotlight: CypherLoc Scareware (Barracuda) blog.barracuda.com · Blog · 2026-05-20
• ThreatCluster: Massive Tech Support Scam Targets Japanese Users with 13M+ Emails threatcluster.io · News · 2026-07-27

More in phishing

• Utility Impostor Scams: Lookalike Domains, Scam Ads and Phishing-as-a-Service (Darcula V3) Targeting Utility Customers
• 110-Domain Fake Copyright-Strike (DMCA/YouTube) Phishing Estate Using Browser-in-the-Browser Google Credential Harvesting
• SkyW4lker-Associated Microsoft OAuth Phishing via Adobe-Hosted PDF Lure (slybee.com)
• Holiday Phishing Scams 2026: Black Friday-Themed Phishing, Quishing, Callback Fraud and BEC Targeting Employees
• BluePhishing: Initial Access via Third-Party Agent Blueprint Consent (Microsoft Entra Agent ID)

Previous and next in phishing

• Fake Gift Card Scam Campaign Exploiting Trusted Brands (PlayStation, Sephora, SHEIN, Walmart, Amazon) Previous report