New Tech Support Scam Exploits Microsoft Logo to Steal User Credentials

According to Cofense Phishing Defense Center, a new tech support scam has hijacked Microsoft's branding to harvest user credentials and push victims to contact fraudulent support lines for remote access. The campaign starts with an innocuous email that imitates a payment notification from a fictitious “Syria Rent a Car,” followed by a counterfeit CAPTCHA designed to look legitimate and deter automated scanners.

After the deceptive CAPTCHA, users are redirected to further pages that create a sense of trust in a Microsoft service, culminating in a coercive phone-based social engineering stage where victims are urged to call a “Microsoft Support” number. When calls are made, attackers pose as Microsoft technicians and seek account credentials or prompt installation of remote desktop software, enabling potential network intrusions and data exfiltration.

The analysis also lists several infection and payload URLs and demonstrates how overlay visuals and urgent messaging drive users toward handover of sensitive information. The report, dated 17 October 2025, emphasises layered defence and ongoing security awareness to counter brand-based phishing campaigns.