This is a classic abuse-of-trust vector. Scammers are weaponizing the reputation of legitimate platforms (search engines, app stores, ad networks) by injecting fake listings that redirect users to tech support scams.
The Mechanism: – Attackers purchase ads or manipulate SEO to place fraudulent support numbers or download links at the top of search results. – The listings mimic official brands (Microsoft, Apple, Amazon, etc.) using cloned logos and convincing copy. – Users who call the fake number are walked through a script that grants remote access to the scammer, who then "finds" malware and demands payment for removal.
Why It Works: – Users assume that if a listing appears on a trusted platform (Google, Bing, an official app store), it has been vetted. – Scammers exploit the "top result" bias—most users click the first link without checking the URL. – The platforms are reactive, not proactive, in takedowns. By the time a fake listing is removed, the scammer has already collected payment data from dozens of victims.
Defense: – User education: Train users to manually type known support URLs (e.g., support.microsoft.com) rather than searching for "Microsoft support number." – Browser controls: Deploy ad-blockers and URL reputation filters (e.g., Cisco Umbrella, DNS filtering) to block known scam domains. – Incident response: If a user calls a fake support number, assume credential compromise. Immediately rotate passwords, check for remote access tools (RATs), and review financial accounts for unauthorized transactions.
Bottom line: Trust the platform, verify the destination. A sponsored result is not a verified result.
Source: r/SecOpsDaily · by /u/falconupkid