Trend Micro identified a large-scale tech support scam campaign that shifted from traditional malvertising to sustained, high-volume email distribution, delivering over 13 million emails over 165 days predominantly to Japanese (.jp) recipients. The campaign leverages spoofed senders, over 240,000 globally distributed sending IPs (likely compromised IoT/MikroTik devices), and more than 33,000 short-lived fake alert sites hosted on Azure Blob Storage to funnel victims toward fraudulent tech support call centers and remote-access-enabled financial theft. A notable evolution since May 2026 is the targeting of employees within organizations using internal-corporate-themed lures, suggesting an effort to secure larger financial payouts.
Sender Spoofing
1 post
13M+ Emails Sent in Tech Support Scam Targeting Users, Organizations in Japan