On August 5, 2026, someone clicked a sponsored link and landed on what looked like Microsoft’s support website. Fake error messages covered the screen, and a chat window told them to call +1 (877) 295-2069 to unlock their computer. The page was hosted on Microsoft’s own Azure cloud, and the phone number was even written into its web address: w8win05m877n2069c004.z13.web.core.windows[.]net.

The link was an ad from Taboola, the company behind the “Recommended for you” story links that appear under articles on many news sites. When someone clicks one of those links, Taboola adds a tracking code to the web address so the advertiser can count the click. That code was still attached to this scam page’s address. Nobody emailed this page to anyone. Someone paid to put it in front of them.

This post traces how pages like this one reach their victims, drawing on the tech-support scam pages PIXM detected between March 2025 and early October 2026. It covers the delivery side of the scam whose phone-call endgame we dissected in Anatomy of a Phish: Engineered Panic, and it goes deeper than our June brief, Ad-Funded Phishing, which first flagged Facebook and Google ad parameters on these pages.

How the delivery chain works

In the pages we analyzed, the chain has four stages:

1. Ad placement. The operator buys inventory on a social, native, or programmatic network. In practice, that means paying for ad slots: a sponsored post in a social feed, a "recommended for you" tile under a news article (native), or a banner auctioned in real time across thousands of websites through an ad exchange (programmatic).
2. Click-through. The ad resolves to a throwaway landing page on Azure Static Websites, Bunny CDN, or Heroku. The URL keeps the platform’s click identifier.
3. Browser takeover. The page renders a Microsoft Support clone with stacked error dialogs and a “Windows Firewall has locked your session” prompt.
4. Callback. All paths end in a phone number. No credential is collected on the page; the fraud happens on the call.¹

Table 1. Components of a programmatic-exchange landing URL (captured Oct 1, 2026).

Why it evades common controls

Email security has no visibility. There is no message, attachment or sender to evaluate. Domain reputation is ineffective: landing pages use web.core.windows[.]net, b-cdn[.]net and herokuapp[.]com, with a new hostname per wave. Ad review evaluates the creative, not the destination. MFA is not in play, since no credential is entered.

Observations from PIXM data

Table 2. Ad channel indicated by click parameters, among ad-tagged tech-support scam pages.

The kit itself changed little across channels. Operators appear to move spend between networks while reusing the same landing page.

Recommendations

• Treat ad-delivered pages as an attack surface; browser- or DNS-level ad blocking on managed devices removes much of this path.
• Evaluate pages on trusted cloud hosts by rendered content, not hosting domain.
• Brief users that Microsoft does not display phone numbers in pop-ups and that closing the tab is safe.
• Use point-of-click page analysis. PIXM’s computer vision identifies counterfeit support screens regardless of delivery channel or hostname.

Indicators

References

1. Anatomy of a Phish: Engineered Panic, One Phone Call From Disaster, PIXM, June 2026.
2. Ad-Funded Phishing: How Facebook and Google Deliver Attacks to Enterprise Browsers, PIXM, June 2026.

Questions, or want to share indicators? Contact [email protected]. To see PIXM’s point-of-click protection, request a demo.