Scareware — Azure-Hosted Tech Support Scam
Defender for Office 365 detected and quarantined an inbound email containing a URL flagged by URL Detonation Reputation at delivery. Analyst sandbox confirmed the URL resolved to an Azure Blob Storage-hosted tech support scam — browser-locking JavaScript, full-screen fake Windows security alert, and a fraudulent UK freephone number. Email quarantined before any user interaction. Zero open events and zero URL clicks confirmed.
Tech support scams (TSS) are social engineering attacks that use fake security alerts to panic victims into calling fraudulent support numbers, at which point attackers install remote access tools or extract payment. The browser-lock technique — which uses JavaScript to intercept browser close events and prevent the user from dismissing the page — is specifically designed to simulate a genuine system lockout and amplify panic.
Azure Blob Storage hosting is an increasingly common evasion technique for TSS campaigns. By hosting the scam page on *.core.windows.net, attackers inherit Microsoft's domain reputation, causing traditional URL reputation filters that extend trust to Microsoft-owned infrastructure to bypass the content. URL detonation-based detection — which analyses runtime page behaviour rather than static domain reputation — is the only reliable detection mechanism for this pattern.
The targeting of a shared service team mailbox is deliberate: a shared inbox has multiple users with access, statistically increasing the probability that someone will open the email before it is reported. The fraudulent UK freephone number on the scam page confirms geographic targeting at UK-based recipients, indicating campaign localisation rather than generic global deployment.
The email was delivered to the shared service team mailbox where Defender for Office 365's URL Detonation Reputation engine triggered at delivery, classifying the email as malicious and routing it to quarantine before it reached the inbox. This is the correct containment point — pre-delivery quarantine is preferable to post-delivery remediation.
Manual sandbox detonation of the URL (hxxps://sarimiwas[.]z13[.]web[.]core[.]windows[.]net/) documented the following page behaviour: a full-screen overlay presenting a Windows security alert warning with Microsoft branding; an "Admin Login" modal positioned in the foreground; a prominently displayed UK freephone number claimed to be Microsoft Support; and JavaScript logic that intercepted the browser's beforeunload event and executed an immediate page reload on any close attempt — implementing the browser-lock.
The browser-lock implementation is competent: it does not simply prevent window closure (which modern browsers restrict) but instead reloads the page, maintaining the alarming state and preventing casual dismissal. Non-technical users experiencing this for the first time would find it genuinely alarming and difficult to dismiss without knowing the Task Manager escape route.
The Azure Blob Storage subdomain (sarimiwas[.]z13[.]web[.]core[.]windows[.]net) cannot be blocked at the domain level without disrupting legitimate Microsoft services. The correct indicator is the specific subdomain URL. Azure static web hosting accounts can be created and deployed rapidly, meaning the campaign URL is likely short-lived — reporting to Microsoft's abuse team (abuse@microsoft.com) is the most effective remediation action to remove the hosted content.
Zero email open events and zero URL click events were confirmed via the admin console — DFO365 quarantined the email before any user interaction occurred.
| Type | Indicator | Notes |
|---|---|---|
| URL | hxxps://sarimiwas[.]z13[.]web[.]core[.]windows[.]net/ | Azure Blob Storage hosted tech support scam page with browser-lock JavaScript |
| Phone | +44 808 XXX XXXX (redacted) | Fraudulent UK freephone number — geographic targeting confirmed |
| Hosting | Azure Blob Storage (z13.web.core.windows.net) | Microsoft cloud infrastructure abused to inherit reputation and bypass URL filters |
| Threat Type | Malware / Spam — Scareware / Tech Support Scam | Browser-lock JavaScript + fake Windows alert + fraudulent callback number |
| MailMessage GUID | d634a8df-[REDACTED]-08de5a979b49 | M365 admin audit trail reference |
| Tactic | Technique | ID | Observed |
|---|---|---|---|
| Initial Access | Phishing: Spearphishing Link | T1566.002 | Link-based email delivery to shared service team mailbox |
| Execution | User Execution: Malicious Link | T1204.001 | Scam designed to elicit user action — call fraudulent support number |
| Defense Evasion | Trusted Infrastructure Abuse / Masquerading | T1199 / T1036 | Azure Blob Storage used to inherit Microsoft domain reputation |
| Impact | Financial Theft / Establish Remote Access | T1657 / T1219 | End goal: victim calls number, attacker installs RAT or extracts payment |
// Confirm delivery action and quarantine location
EmailEvents
| where NetworkMessageId == "d634a8df-[REDACTED]-08de5a979b49"
| project Timestamp, RecipientEmailAddress, DeliveryAction, DeliveryLocation, ThreatTypes, DetectionMethods
// Confirm zero user clicks on the Azure Blob URL
UrlClickEvents
| where Url contains "sarimiwas.z13.web.core.windows.net"
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
// Hunt for other Azure Blob scam URLs in last 7 days
EmailUrlInfo
| where Url contains "z13.web.core.windows.net"
or Url contains "z22.web.core.windows.net"
or Url contains "z6.web.core.windows.net"
| join EmailEvents on NetworkMessageId
| project Timestamp, RecipientEmailAddress, Url, DeliveryActionSandbox was primarily used for documentation rather than detection — DFO365 had already quarantined the email before analyst involvement. The Azure Blob hosting technique is increasingly common and well-suited to bypassing reputation-based URL filters.
The browser-lock JavaScript implementation was competent — it intercepted the standard close event and executed an immediate page reload. Non-technical users would find this genuinely alarming and difficult to dismiss without knowing the Task Manager escape route.
The fraudulent UK freephone number confirms geographic targeting at UK-based recipients — indicating campaign localisation rather than a generic global deployment.