800TollFreeNow, scammers answer as Microsoft despite their popup also being used to impersonate Apple
https://uusa7.z28.web.core.windows.net/merrx01usahtml/?bcda=1-844-540-7421#
- The scammer, “James,” claimed an “attempt of hacking” took place within the past 48 hours, prompting you to “connect to the secure server of the Microsoft” by running UltraViewer (ID: 76141982) and the command prompt.
- Once “James” remotely connects to my virtual machine, he wanted me to run the “netstat” command so he can falsely claim there was “four Chinese and Russian hackers” were on my IP address and asked me to write down his Twilo line, (659) 258-8965.
- “James” then reported the case to his “fraud supervisor” and performed a “final scan” with the “dir/s” command before claiming that my financial information was used to PURCHASE CHILD PORN ON PORNHUB, prompting them to “automatically report the case to the FCC.”
- “James” then blocked my TextNow line, but was still remotely connected to my virtual machine. I then opted to play him the Bhenchod Song.
