Con artists are targeting thousands of people with tech support scams that pose as security alerts from Norton Security, researchers at Symantec have found. The phony alerts pop up in the browser and urge the victim to run a quick scan of their computer. If the user clicks “OK,” they’ll see a very realistic-looking fake Norton scan running, which tells them their computer is infected. They’ll then be prompted to download an “update” for their antivirus software, which is actually a potentially unwanted application (PUA).
While tracking this scam, the Symantec researchers discovered an unsecured attacker dashboard, which revealed that the scammers had compromised tens of thousands of victims. The dashboard shows that the attackers are paid by the volume of successful PUA installations, and this particular scam netted them at least $25,000.
The researchers emphasize that there are several red flags here that could have alerted educated users to the scam. First, files on your hard drive can’t be scanned by a website in a browser. Second, Norton scans and updates are handled through the product’s GUI, while the initial alert in this case was obviously browser-based. Additionally, the scam contained several hardcoded elements that wouldn’t have applied to every user, such as “30 days of subscription remaining.” New-school security awareness training can teach your employees to look for suspicious activity and details that are out of place or unexpected. Symantec has the story: