HIGHLIGHTS FROM VIRTUAL MACHINE BAIT:
- The scammer answered as “cancellation suppoat for Norton” and claimed you were a valued customer of Norton. In order to “cancel,” you are asked to “open the Google Chrome” and go to gobw.top (Code: 41120, IP: 154.53.51.69
), which I have already done earlier today. - Once the scammer remotely connected to my virtual machine, they blanked out my screen with a fake software update while he brings up the “cancellation form” and asked me to change my password and write the “cancellation ID:” NORTON19945
. - I was then asked to hang up the call so I can receive a call from his “finance manager, David Dawson,” from his TextNow line (786) 490-4997 and was asked to complete a “refund process” by logging into my nonexistent bank account. Since I don’t do online banking, I played him the Bhenchod Song.
https://pcsec111.org/ is an iFrame of https://sup2.ps111.ru/guest.aspx