{"id":11712,"date":"2018-03-09T13:10:23","date_gmt":"2018-03-09T21:10:23","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2018\/03\/09\/news-5482\/"},"modified":"2018-03-09T13:10:23","modified_gmt":"2018-03-09T21:10:23","slug":"news-5482","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2018\/03\/09\/news-5482\/","title":{"rendered":"Tech support scammers GeeksHelp caught again, two years later"},"content":{"rendered":"

Credit to Author: Malwarebytes Labs| Date: Fri, 09 Mar 2018 20:08:25 +0000<\/strong><\/p>\n

Many researchers have noted an increase in tech support scam activity during the past few months. This trend,\u00a0facilitated by browser lockers, is not surprising considering that other web-based infection methods are not as effective.<\/span><\/p>\n

While people are still receiving cold calls from alleged Microsoft technicians, crooks are mostly relying on other means to get their call centers busy, which they often do by purchasing leads.<\/span><\/p>\n

During an investigation into a particular strain of tech support scams<\/span>, we came across the same scammers we had already exposed in May 2016<\/a>.<\/span><\/p>\n

Click to view slideshow.<\/a> <\/p>\n

After calling the number posted on the fake Windows alerts, a technician prompts victims to download remote software required to take control of their computer. The company is called GeeksHelp, aka AmericaGeeks, previously known to us as Geeks Technical Solutions LLC, which\u00a0<\/span>operates out of Chandigarh, India.\u00a0<\/span><\/p>\n

\"\"<\/p>\n

The company claims that they are working with Microsoft and that the number posted on the tech support scam page is from Microsoft\u2019s headquarters, redirecting to them for assistance.<\/span><\/p>\n

\n

When you call on this particular number, first your call will be routed to the Microsoft headquarters. And after that the headquarters route all these calls to us.<\/p>\n

Actually in America we are the only one who are providing support on Microsoft issues.<\/p>\n<\/blockquote>\n

https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/03\/AmericasGeek.mp3<\/a><\/audio> <\/p>\n

The sales pitch invariably turns into purchasing a support plan to get rid of the “computer viruses.”<\/span><\/p>\n

\"\"<\/p>\n

To make matters worse, AmericaGeeks also provides unauthorized Malwarebytes support:<\/span><\/p>\n

\"\"<\/p>\n

We discovered that this company is targeting the French with the same tactics, but with a localized native language tech support service.\u00a0<\/span>This time, the call center responding to the calls is named GeeksFrance. Their website, geeksfrance[dot]com,<\/em>\u00a0displays the different plans they offer, ranging from 99.99 euros to 499 euros.<\/span><\/p>\n

This company lists an address in France: <\/span>7 Boulevard de la Liberation City Marseille, Provence-Alpes-C\u00f4te d 13014,<\/span><\/i> but <\/span>according to a job offer for inbound call sales associates<\/a>\u00a0<\/span>found online, they are more likely located in Tunisia, a country where over 60 percent of the population can speak French<\/a>.<\/span><\/p>\n

\"\"<\/p>\n

Just like the scammers from the Indian call center, the rogue Tunisia-based techs also come up with false statements about the state of their victim’s computer. The final invoice page looks identical to the one used by AmericaGeeks.<\/span><\/p>\n

\"\"<\/p>\n

This is not surprising because the infrastructure that powers the French version of the scam (geeksfrance[dot]com<\/em>) can be tied to the original group we identified back in 2016, Geeks Technical Solutions LLC (geekstechnicalsupport[dot]com<\/em>), by the same IP address (216.172.183.76<\/em>) where both domains are hosted.<\/span><\/p>\n

Victims of tech support scams often have to part with hundreds of dollars and, in some cases, crooks will further manipulate them in order to collect even more.\u00a0<\/span>The scam only really works if people make the call first, which is why browser lockers are a big part of these schemes.<\/span><\/p>\n

Despite efforts to curb the rapid proliferation of tech scams, we are witnessing intense activity and more outsourcing of roles and responsibilities, which not only contribute to better efficacy but also make it harder for law enforcement to tackle them on a global scale.<\/span><\/p>\n

The post Tech support scammers GeeksHelp caught again, two years later<\/a> appeared first on Malwarebytes Labs<\/a>.<\/p>\n

https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Credit to Author: Malwarebytes Labs| Date: Fri, 09 Mar 2018 20:08:25 +0000<\/strong><\/p>\n\n\n\n
<\/a><\/td>\n<\/tr>\n
Almost two years after exposing a group of tech support scammers, we stumbled upon them again, this time under the moniker GeeksHelp.<\/p>\n

Categories: <\/p>\n