On April 15, 2025, I was tipped on a video by the YouTuber Scambaiter, with assistance from Mrwn, on a group of Microsoft technical support scammers that operate out of several apartments at Indiabulls Centrum Park at Dwarka Expy, Sector 103, Gurugram, Haryana 122006, India in an attempt to avoid being caught by police. These guys don’t appear to work for any known company, but have been simply identified as the “Anubhav Work Office.”
The scammers, in this case, generate fake virus popups and pose as “Level 7 Microsoft technicians” from Denver, Colorado. As part of their script, the scammers will falsely claim their victims’ computer was infected by csrss.exe (the Client/Server Runtime Subsystem) and used by 8 hackers to download child pornography, scaring the victim into paying hundreds of dollars for a fake “security plan.”
Later on, the scammers will follow another script, or in their words a “call pitch,” from an individual who calls themself “Dadi” falsely claiming the victim will be reimbursed money used for “drivers not compatible with their operating system.” In addition to using Google Forms as their platform for fake refund forms, the scammers also use microsoftrefund.com to facilitate refunds for “MicrosoftLifeLock”
The victims will be deceived into receiving too much money and be urged to pay the scammers with gift cards, wire transfers or cryptocurrency. It is believed that the stolen funds are being laundered through Chinese money laundering groups.
The fake virus popups have been generated by A3 Infotech, Capital and Infogen Known scammers in the call center are:
- Haseen, a 35-year-old opener who goes under the identity of “Sam Thomas”
- Rejender, a closer from Delhi
- “Tom Hanks,” a Chinese money launderer.
- A female money launderer
