— Ingenious AI security check.
Microsoft never shows a phone number in a browser security warning and never asks you to call support from a popup. A real Windows alert lives in the operating system, not a web page — if the ‘alert’ traps you with exit-prevention scripts or demands immediate action, it’s a tech-support scam. Force-quit the browser and restart without restoring tabs.
A scam where criminals pose as Microsoft or Apple support — via fake browser alerts, cold calls, or popups — to trick victims into paying for fake fixes or installing remote-access software.
On October 15, 2026, researchers at Infoblox reported that a long-running scam network called Help TDS — now linked to an affiliate program named Hotejka — is serving fake Microsoft Windows security alerts across more than 20,000 domains on Cloudflare's free hosting. The alerts lock your browser, show a phone number, and the call center on the other end talks victims into installing remote-access software. It is a phishing operation run through the browser: the alert is the lure, the phone call is the trap. Spot one in 30 seconds with the check below. No signup, nothing installed.
You can't close the tab. The page goes fullscreen, or the alert pops straight back when you try to leave. Real Microsoft warnings never trap your browser.
It shows a phone number to call. Microsoft will never ask you to call a number from a browser popup. That number reaches a scam call center, not support.
Scare language and fake error codes. "Virus detected!", "Your computer is blocked", long codes like 0x800... — all written to panic you into acting fast.
It tells you to install something. Especially "remote support" or screen-sharing software. That is the actual goal: getting inside your computer.
Check the address bar. If it is not microsoft.com, it is not Microsoft. This wave runs on throwaway domains, many on free pages.dev hosting.
Looking at a warning right now? Tick everything that matches what is on your screen, then score it. Nothing is sent anywhere — the check runs on this page, on your device.
This is not random popups. It is one researched operation, measured by the team that disclosed it:
| Scale | 20,000+ domains serving the fake alerts, rotating daily |
| Hosting | Cloudflare free hosting — many lure pages on pages.dev subdomains |
| Operator pattern | Help TDS, a traffic-distribution network, now linked to an affiliate program named Hotejka |
| Disclosed | Infoblox threat research, October 15, 2026 |
| The lure | A fake Microsoft Windows security alert that locks the browser with exit-prevention scripts |
| The trap | The phone call: a scam call centre talks the victim into installing remote-access software |
| The side business | Traffic that does not convert is resold to fake "verify you are human" pages that harvest notification permission for spam |
Every figure above is from the Infoblox disclosure of this wave — no estimates added.
Source: Infoblox threat research on Help TDS / Hotejka, reported October 15, 2026.
This page showed you how to spot the scam. DomainGuard watches for lookalike domains impersonating your brand before customers meet them.
No. Microsoft never displays a phone number in a browser security warning and never asks you to call support from a popup. Any number on a browser alert reaches a scam call center whose job is to talk you into installing remote-access software.
Revoke it now: open your browser Settings, go to Privacy / Site settings / Notifications, find the site and remove it. Scam networks abuse notification permission to push spam and fake warnings straight to your desktop long after you leave the page.
The page runs scripts that force fullscreen and re-trigger the alert when you try to leave — deliberate exit-prevention, not a real system warning. Force-quit the browser (Alt+F4 on Windows, force quit on Mac) and restart without restoring tabs.
Yes — it is a phishing lure delivered through the browser instead of email. The fake alert creates panic, and the “support agent” on the phone harvests your credentials, payment details, or remote access. The same rule applies: never trust an unsolicited security warning that demands immediate action.