Tech support scams are social engineering schemes in which threat actors impersonate technical support or customer service from well-known, trusted companies. The threat actors contact their targets to gain access to the target’s device, obtain sensitive data, such as account credentials or personal information, steal funds, and/or download malicious software.
The NJCCIC received a report of a tech support scam in which threat actors impersonated Microsoft and targeted a public sector organization. The target received an unsolicited call from threat actors claiming to respond to a support ticket. They instructed the target to log into a computer and download Quick Assist, a legitimate remote support tool that threat actors frequently abuse. If a code is provided and remote access is granted, threat actors can view the screen and request full control of the computer. After full control is granted, the threat actors can steal passwords, exfiltrate data, deploy malware, and launch ransomware attacks.
Microsoft does not proactively call to request remote access to your device for technical support. Legitimate Microsoft technical support agents will use official channels, such as the Microsoft Support website or the Get Help app. If someone calls claiming to be Microsoft and demanding remote access, hang up immediately.
Recommendations:
- Exercise caution with communications from legitimate services, including unsolicited phone calls.
- Confirm caller requests by using contact information obtained from verified, official sources.
- Refrain from granting remote access, divulging sensitive information, or providing funds.
- If sensitive information was divulged or entered, change passwords for compromised accounts, notify financial institutions of fraudulent transactions, monitor for unauthorized activity, and review the Identity Theft and Compromised PII NJCCIC Informational Report.
- Review the Tech Support Scams NJCCIC Product for more information and recommendations.