On January 28, 2026, our good friend @NanoBaiter uploaded a video to his YouTube channel exposing a group of refund scammers and shutting down their operations by infecting every single computer of theirs with malware.
The culprits behind this particular scam are employees of QBS Consulting, LLC, a company that does do legitimate work during the daytime hours but also falsely claims to operate out of Florida and Brentwood, Tennessee and operates under the business identity of “Max Web Arvada Solutions” following a 2025 merger between “Arvada Technologies” and “Max Web Solutions.”
While the scammers’ website remains active at this time, the hyperlink I had included in the above paragraph redirects to an archived version as the current website contains malicious code designed to appear like a simple captcha to American visitors, but actually trick them into running malicious Powershell code that is believed to steal cryptocurrency.
The company is primarily headquartered at the Ithum Tower at GALAXY BUSINESS PARK, Block A, Industrial Area, Sector 62, Noida, Uttar Pradesh 201309, India, the scammers actually operate from several different call centers several blocks apart from one another.
In addition to facilitating printer support scams, the company is largely known for facilitating refund scams with a simple modus operandi:
- Their scam starts off with a fraudulent email or phone call purporting that the victim was charged $200 for products or services on Amazon or McAfee
-
- The dialers used in this case were identified as NextivaONE, RingCentral and X-Lite
- When the victims dispute the bogus charge, the scammers will remotely gain access to their victims’ computer through TeamViewer or UltraViewer and manipulate stuff to trick the victim into thinking they received a refund of $20,000
-
- The scammers are banned from using AnyDesk
- The scammers will then demand that the victim withdraw $19,400 from their bank account and hand it off to a designated courier or money mule.
- In addition to being paid normally, the call center employees will also be given incentives based on how many people they scam.
In addition to refunding as many victims as possible, Nanobaiter shut down the call centers’ operations by infiltrating their networks and installing countless viruses on their computers, including
- BonziBUDDY, a discontinued freeware virtual assistant that contained a backdoor trojan to collect information from its users, install a browser toolbar, serve advertisements and constantly reset the user’s homepage
- BonziKILL, A modified variant of BonziBUDDY designed to destroy computers by running destructive payloads, as well as programs such as Netscape Navigator, LimePro and PC Optimizer Pro
- Butterflies on the Screen, a trojan that displays little butterflies on the screen that are actually pieces of code that collects data from the user’s desktop and prohibits the user from using the Task Manager.
- Spongebob.exe, a creepypasta virus that functions similarly to the MEMZ and MrsMajor trojans, complete with MBR overwrite
- You Are An Idiot, a web-based trojan that bounces the browser window across the screen and opens six smaller windows that do the same thing when the user tries to close it.
Associated Phone Numbers:
- +91 99539 41916
- (850) 608-4984 (Twilio with SMS/MMS enabled)
Associated Email Addresses: