PayPal/Norton/Scamazon/Affordable Connectivity Program (MULTIPLE NUMBERS)

image

‪(551) 327-3410‬ is an Onvoy line, (831) 607-8633 is a Bandwidth.com line carried via Skype.

HIGHLIGHTS FROM VIRTUAL MACHINE BAIT:

  • The scammer will claim I was a user of a “free version” of Norton Lifelock, prompting you to “open the Google Chrome” by going to tiny.cc/cancelforhelp and downloading AnyDesk (ID: DELL/404904408 Password: amazon123).
  • Once the scammer remotely connects to my virtual machine, they will attempt to download their version of ConnectWise from a Russian domain. Since that didn’t work, they then attempted to disable firewall protection and s mode.
  • Our phone call got disconnected, so they prompted me to call their Magic Jack line ‪(754) 816-7013‬ before running a “security scan” with the netstat command on the command prompt.
  • The scammer will then open Task Manager and run a command from the “PayPal Security” before having one of his fellow employees, Ben, call from their Magic Jack number ‪(704) 681-5989‬.
  • “Ben” then darkened my screen before having me fill out a “cancellation form,” where they claimed to be the “Affordable Connectivity Program” before being asked to “login to my online internet banking account”
  • Since I don’t do online banking, I was asked to open a new tab and log into my “online banking account.” I instead played him the bhenchod song.