Microsoft-branded SysScan sites use fake scans for refund scams

A network of fraudulent websites using the Microsoft-branded name ‘SysScan’ is targeting users with fake security scans to facilitate refund scams. These sites imitate a legitimate security-scanning service, falsely claiming that Windows no longer supports third-party antivirus products.

According to Malwarebytes, the websites do not perform actual system-wide assessments. Instead, they collect basic browser information—such as user agent, screen resolution, and approximate location—to construct a fabricated diagnosis. The sites include hard-coded claims regarding compromised browser sandboxes and missing Trusted Platform Modules (TPM). Notably, the security scores are rigged; the code restricts results to a failing range between 13 and 30 out of 100, ensuring no user can receive a passing grade.

The scam directs users to uninstall their existing antivirus software, after which it steers them toward a refund trap. Eleven of these sites have been identified as operating from a single IP address, and stolen data, including banking and remote access details, is reportedly sent to attackers via Telegram bots.