Tech-support scams turn a website visit into a support call.

A tech-support scam page claims the visitor's computer or phone is locked, infected or involved in a suspicious payment, then tells them to call support. On a compromised website, injected JavaScript loads a remote stage that redirects the browser to that page.

compromised website
  -> injected script fetches and runs a remote stage
  -> redirect through changing hosts
  -> fake security alert, full-screen warning or locked-screen page
  -> alarm, exit traps and an attacker-supplied support number

An injected loader sends the visitor to the alert

StripCall fetches a remote response with cache: "no-store", removes its script wrappers and runs the text with eval. Its stage sends the browser through a randomly generated sslexmo[.]info subdomain and path. The captured chain reaches a fake Microsoft Firewall and Defender warning that asks the visitor to call Windows support.

Other fetch-and-strip loaders run the returned text through indirect eval or the Function constructor.

HelpTDS needs no loader. A meta refresh, a script above the doctype or a changed WordPress site URL sends the visitor to a /help/ stage on a throwaway Cloudflare Pages host, which forwards an encrypted token to a fake Emotet alert.

The page makes a browser tab look like a locked computer

Fake Windows warnings request full-screen mode, hide the cursor and call navigator.keyboard.lock(). Keyboard handlers suppress keys such as Escape and the refresh key. The Microsoft alert reached through the captured redirect chain adds pointer lock and alarm audio. English and Japanese warning pages repeat support numbers beside claims that access to the system has been blocked.

The number can come from a phone query parameter. One Windows error page decodes a percent-encoded HTML wrapper, writes that number into repeated warnings, requests full-screen mode and loops an alarm. Other pages put a Windows ID and password prompt beside the support number.

Leaving the page triggers more interference. Scripts add browser-history entries and replace them when the visitor presses Back, use beforeunload handlers to interrupt navigation, and keep warning overlays visible. An anti-exit script hides this behaviour from Meta and Google ad-review crawlers before installing its history and full-screen traps.

Phone lures reopen warnings and telephone links

Fake Apple support pages claim an Apple Pay charge or illegal activity has locked the device. Some open a tel: handler as soon as the page loads. Others reopen a dismissed alert, repeatedly trigger telephone links or flood the page with call links.

One Japanese warning page arrives encrypted. The script checks an HMAC, decrypts the page with a key taken from the part of the address after #, and writes it over the document in full screen with alarm audio. It then asks peyave[.]cfd, an address hidden under a second layer of encryption, for phone numbers every 20 seconds and fills five number slots, so the operator can change the number on every open page at once.

What we see across these sites

Month	New sites
September	326
October	238
November so far	124

Of the 401 sites captured since 25 September, 189 ran WordPress. Among those WordPress sites, 54 had Contact Form 7 and 42 had Elementor.

Of the 170 sites recaptured at least 25 days after their first match, 140 still served tech-support scam code (82%).

Finding and removing the redirect

Preserve the page source and network log, then compare the website with a trusted deployment. Check for:

• added scripts that fetch remote text, strip script tags and pass the result to eval or Function
• redirects through changing subdomains before a Microsoft, Windows or Apple warning
• a support number supplied by a URL parameter or a separate configuration script
• full-screen, keyboard-lock and pointer-lock calls beside a fake security alert
• alarm audio, suppressed keyboard events, history traps and beforeunload handlers
• repeated telephone links or alerts that reopen after dismissal

Remove the injection and restore changed site files from trusted sources. Review CMS, hosting and deployment access, rotate affected credentials and clear caches. Test the original reported path again and record every redirect it makes.