# Large-Scale Tech Support Scam Email Campaign Targeting Users and Organizations in Japan (13M+ Emails)

> Trend Micro observed about 13.38 million spoofed scam emails (94% to .jp addresses) between mid-December 2025 and May 2026. They lead to disposable fake security alert sites on Azure Blob Storage static website hosting that push victims to call scam phone numbers; from May 2026 lures shifted to workplace themes such as performance reviews and salary revisions.

- **Published:** 2026-11-09T11:00:11Z
- **Last reviewed:** 2026-11-09T11:00:11Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5543
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5543.png
- **ID:** TL-2026-5543
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 24 (1 shown free below)

## Description

Trend Micro Research (published 2026-07-23) documents a high-volume tech support scam (TSS) campaign that shifted from mostly malvertising to mass email distribution starting mid-December 2025. Over 165 days Trend Micro observed roughly 13.38 million emails (about 81,000/day average), peaking at about 4.45 million in February 2026 (about 160,000/day) and falling to about 30,000/day by May 2026. About 94% were addressed to .jp domains. More than 33,000 disposable fake security alert sites were used, about 90% of them linked from emails for only a single day.

Email delivery: more than 90% of sender addresses were spoofed, either to match the recipient's own address or to impersonate legitimate services and organizations (their real sending addresses were forged). Emails were sent or relayed from more than 240,000 IP addresses worldwide; Brazil had the highest volume and China the most unique IPs. Header timestamp offsets suggest hijacked IoT devices and similar equipment. A Shodan review of the top 10,000 sending IPs found 3,231 hosts running services that appear to be MikroTik devices, 2,657 of which had TCP port 2000 reachable from the internet; other services were OpenSSH (284), nginx (184) and Apache (144), while 5,940 had no confirmed service. Lures started with fake warnings and adult/explicit content, added impersonation of e-commerce, transport and financial institutions, the National Tax Agency and job listings in mid-April 2026, and from May 2026 targeted individuals inside organizations with workplace themes (internal security audits, performance evaluations, salary revisions, promotion lists, commuting expense rules, compliance complaints, emergency contact re-registration, system maintenance login tests, tax refund procedures), often with fake HR system IDs and confidential/urgent framing.

Landing sites and scam mechanics: the fake alert pages were hosted on Microsoft Azure Blob Storage static website hosting over HTTPS, with encrypted content to hinder analysis. Related reporting from Forcepoint X-Labs (2026-03-11) on a similar Japan/Germany scareware run describes randomized *.web.core.windows.net subdomains, an AES-256 encrypted payload gated by an HMAC-SHA256 check with the key held in the URL fragment, forced full-screen mode, blocked keyboard/right-click/DevTools, an auto-playing Japanese audio warning, anti-exit tab reloads and Web Worker freeze loops, and a Japanese Microsoft Defender lookalike alert. Barracuda (2026-05-20) describes the similar CypherLoc scareware kit (fragment-keyed AES payload, HMAC-SHA256 integrity check, (0,eval) execution, history.replaceState fragment removal, DevTools-triggered anti-analysis, victim public IP display). Trend Micro notes Barracuda's sites share a similar structure; it does not state that the campaigns are identical.

Monetization: the victim calls a number shown on the page; the scammer poses as tech support, persuades the victim to install remote access software (LogMeIn, UltraViewer, ScreenConnect, RustDesk, AnyDesk, TeamViewer are named as commonly abused), and pushes the victim to pay support fees or wire money. In confirmed organizational cases the victim was directed to log in to online banking while the scammer controlled the device. Between 2026-02-26 and 2026-05-31, 4,721 alert sites displayed only 11 distinct phone numbers, all international (mainly North American); numbers persist for a week or more even though sites last about a day. Trend Micro's IoC list holds 12 numbers as of 2026-06-12. No attribution is stated. Japan's National Police Agency reported 1,048 support-pretext billing fraud cases in 2025 (down 31.2%) with about 1.49 billion yen in losses (up 48.1%).

## MITRE ATT&CK

- T1583.006 Web Services
- T1584.008 Network Devices
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1059.007 JavaScript
- T1684.001 Impersonation
- T1027.013 Encrypted/Encoded File
- T1480.001 Environmental Keying
- T1219.002 Remote Desktop Software
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TL-2026-5543 Tech Support Scam Alert Page on Azure Static Website Hosting (web.core.windows.net) - Exploitation** (`TL-2026-5543-SPL-001`)

Detects web proxy requests to randomly named Azure Blob Storage static website hosts (random label, optional zNN shard, web.core.windows.net) used for the disposable fake security alert pages in the Japan tech support scam email campaign (TL-2026-5543). The pages use fragment-keyed encrypted JavaScript payloads (T1027.013, T1059.007, T1480.001) and are reached by users clicking emailed links (T1566.002, T1204.001). The parent domain is a legitimate Microsoft service, so the logic keys on the random-label host pattern and an optional mail-client referrer rather than blocking the domain.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.002, T1204.001, T1583.006, T1059.007, T1027.013, T1480.001
- **Data sources:** zscaler_nss_web_proxy (index=proxy, sourcetype=zscalernss-web), microsoft_defender_for_endpoint (DeviceNetworkEvents), web_proxy_logs
- **Severity:** medium
- **Confidence:** medium

### Splunk SPL

```spl
index=proxy earliest=-24h sourcetype="zscalernss-web" action=Allowed "web.core.windows.net"
| eval dest_url=lower(coalesce(url, requested_url)), referrer=lower(coalesce(http_referrer, referer, ""))
| eval site_host=mvindex(split(replace(dest_url, "^https?://", ""), "/"), 0)
| where match(site_host, "[.]web[.]core[.]windows[.]net$")
| eval random_label=if(match(site_host, "^[a-z0-9]{5,20}([.]z[0-9]{1,3})?[.]web[.]core[.]windows[.]net$"), 1, 0)
| eval mail_referrer=if(match(referrer, "(mail[.]|outlook|safelinks|webmail)"), 1, 0)
| stats count min(_time) as first_seen max(_time) as last_seen values(site_host) as site_hosts values(dest_url) as urls max(mail_referrer) as mail_referrer max(random_label) as random_label by user, src
| where random_label=1
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen user src site_hosts urls mail_referrer count
```

### Microsoft KQL

```kql
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has 'web.core.windows.net'
| where InitiatingProcessFileName in~ ('chrome.exe', 'msedge.exe', 'firefox.exe', 'iexplore.exe', 'brave.exe')
| extend SiteHost = tolower(tostring(parse_url(iff(RemoteUrl startswith 'http', RemoteUrl, strcat('https://', RemoteUrl))).Host))
| where SiteHost matches regex @'^[a-z0-9]{5,20}([.]z[0-9]{1,3})?[.]web[.]core[.]windows[.]net$'
| summarize Visits = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Urls = make_set(RemoteUrl, 10) by DeviceName, InitiatingProcessAccountName, SiteHost
| project FirstSeen, LastSeen, DeviceName, InitiatingProcessAccountName, SiteHost, Urls, Visits
```

### Sigma

```yaml
title: TL-2026-5543 Tech Support Scam Alert Site on Azure Static Website Hosting
id: 7c1d4e2a-3b58-4f0e-a6d9-1e2b9c5f8a01
status: experimental
description: Detects web proxy requests to randomly named Azure Blob Storage static website hosts (random label, optional zNN shard, web.core.windows.net) used for disposable fake security alert pages in the Japan tech support scam campaign TL-2026-5543.
references:
    - https://www.trendmicro.com/en_us/research/26/g/tech-support-scams-targeting-japan.html
    - https://www.forcepoint.com/ko/blog/x-labs/scareware-campaign-targets-japan-germany
author: Threadlinqs Team
date: 2026-11-09
tags:
    - attack.initial-access
    - attack.t1566.002
    - attack.execution
    - attack.t1204.001
    - attack.t1059.007
    - attack.resource-development
    - attack.t1583.006
    - attack.defense-evasion
    - attack.t1027.013
    - attack.t1480.001
logsource:
    category: proxy
detection:
    selection:
        cs-method: 'GET'
        cs-host|re: '^[a-z0-9]{5,20}([.]z[0-9]{1,3})?[.]web[.]core[.]windows[.]net$'
    condition: selection
falsepositives:
    - Legitimate static websites hosted by organizations on Azure Blob Storage
    - Developer and QA preview sites
level: medium
```

**Known false positives:**

- Legitimate organization-owned static sites hosted on Azure Blob Storage static website hosting
- Developer or QA preview sites on randomly named storage accounts

**Tuning notes:** Allowlist storage accounts your organization owns (match site_host against an asset lookup). Adjust the sourcetype and field names (url, http_referrer) to your proxy (Palo Alto, Bluecoat, Netskope). Raise priority when mail_referrer=1 or the host is first-seen in the last 7 days; the alert pages live about one day so alert quickly. Do not block web.core.windows.net wholesale.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TL-2026-5543 Spoofed Inbound Email Addressed From the Recipient's Own Address or Linking to Azure Static Sites - Exploitation (locked: unlock with TL Creds)
- TL-2026-5543 Remote Access Tool Installed as a Windows Service - Post-Exploitation (locked: unlock with TL Creds)
- TL-2026-5543 Remote Access Tool Establishing Outbound Sessions to Public Relays - C2 (locked: unlock with TL Creds)
- TL-2026-5543 Inbound TCP/2000 to Internet-Exposed MikroTik Device - Exploitation (Relay Infrastructure) (locked: unlock with TL Creds)
- TL-2026-5543 Silent or Unattended Remote Access Tool Install with Password or Service Flags - Post-Exploitation (locked: unlock with TL Creds)
- TL-2026-5543 DNS Resolution of Remote Access Tool Relay Domains - C2 (locked: unlock with TL Creds)
- TL-2026-5543 Remote Access Tool Launched from Browser or User-Writable Path (AnyDesk, TeamViewer, ScreenConnect, RustDesk, UltraViewer, LogMeIn) - Post-Exploitation (locked: unlock with TL Creds)
- TL-2026-5543 Outbound Call to Known Tech Support Scam Phone Number - C2 / Impact (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 24)

Defanged, TLP:CLEAR.

- Domain: `web[.]core[.]windows[.]net`

Full set of 24 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [13M+ Emails Sent in Tech Support Scam Targeting Users, Organizations in Japan (Trend Micro Research)](https://www.trendmicro.com/en_us/research/26/g/tech-support-scams-targeting-japan.html)
- [Threat Spotlight: CypherLoc Scareware (Barracuda)](https://blog.barracuda.com/2026/05/20/threat-spotlight-cypherloc-scareware)
- [Scareware Campaign Targets Japan and Germany (Forcepoint X-Labs)](https://www.forcepoint.com/ko/blog/x-labs/scareware-campaign-targets-japan-germany)
- [Japan National Police Agency - Special fraud statistics 2025 (hurikomesagi_toukei2025)](https://www.npa.go.jp/bureau/criminal/souni/tokusyusagi/hurikomesagi_toukei2025.pdf)
- [Trend Micro press release: tech support scams as major consumer threat in Japan](https://www.trendmicro.com/ja_jp/about/press-release/2024/pr-20240425-01.html)
- [Trend Micro Japan: fake emails tech support scam (earlier Japanese-language report)](https://www.trendmicro.com/ja_jp/research/26/f/fake-emails-tech-support-scam-japan.html)
- [ThreatCluster: Massive Tech Support Scam Targets Japanese Users with 13M+ Emails](https://threatcluster.io/cluster/13m-emails-sent-in-tech-support-scam-targeting-users-organiz-882dc726)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5543