The scammers don't have very convincing explanations

Jan 14, 2014 11:35 GMT  ·  By

Tech support scammers are constantly adapting their schemes. They don’t target just Windows and Mac OS users, but also people who own smartphones and tablets.

Researchers from Malwarebytes have noticed that, when searching on Bing for “Android slow tech support,” the sponsored ads point to shady tech support websites. Experts believe this technique might be more efficient than calling up random people.

That’s because they know that people who search for “Android tech support” are more likely to fall for their scam compared to people they call out of the blue.

The websites promoted via sponsored ads on search engines are typical for tech support scams. They instruct users to call a certain number to connect with a technician.

Malwarebytes’ Jerome Segura highlights an interesting thing about tech support scams that target mobile device users. When Windows or Mac customers are targeted, it’s easy for the scammers to come up with a “technical” explanation for the bogus errors.

However, when it comes to mobile devices, it’s a bit more complicated. First of all, they ask victims to connect their smartphone or tablet to the computer. Then they instruct them to install remote access software.

While on a computer they can get the victim to run a Windows utility that can be easily manipulated to display what appear to be errors, the task is much more difficult to accomplish on a mobile device.

In the case of the scam analyzed by Malwarebytes, the scammer deleted some files, which he said were viruses, and quickly restored them from the Recycle Bin to show that the viruses are persistent.

Other than that, his explanations weren’t too convincing.

“There is one file which is installed in your computer as well as in your mobile phone and that is a very bad file. The name of that file is rundll ok? r-u-n-d-l-l number 32 dot exe alright?” the scammer said at one point.

Of course, rundll32.exe is a standard Windows file, not a “very bad file.”

Check out a video recording of this particular scam: