Don’t Be an April Fool: Inside a Common Phone Scam
Summary: A Unit 42 analyst named Robert received an unsolicited tech support scam call on March 30, 2016, in which the caller claimed his Windows system was compromised and used social engineering to walk him through opening the event viewer and running commands. The scammer directed him to support.me, which redirected to secure.logmeinrescue.com, then transferred files including AA_v3.exe, a variant of the Ammyy Admin tool, and a batch script that printed fake hack attempts before pitching protection plans priced from $199 to $299.
What's compelling: The operation relied on two legitimate remote administration tools, LogMeIn Rescue and Ammyy Admin, and Palo Alto Networks identifies 93 remote access applications with App-ID that organizations can use to block them - a concrete control against a scam that otherwise depends on a user clicking through UAC prompts.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026