Explain how scammers got to me

Leon2 · 2025-05-14T16:31:24+00:00

There was an error rendering this rich post.

I consider myself to be a savy user when it comes to safely browsing the internet. I have a windows 11 computer. I use chrome with "enhanced" security setting. I use bitdefender total security and bitdefender VPN. Yet, how did those bottom feeder scammers get to me? I'm not saying I fell for their scam because I recognized it immediately. I clicked on the "X" and it caused the screen to takeover my entire screen. I was able to exit full-screen mode and exit chrome, restarted my PC and it's gone. But, how is it that these scammers were able to bypass all the security settings and that I did not get a warning from Bitdefender that the site contained malicious malware? With VPN on, etc. Isn't this was bitdefender is supposed to help with? If they got to me, a savvy user, I can imagine why non-savvy users get scammed so easily.

Find more posts tagged with

scam alert

scammers

Accepted answers

All comments

Gjoksi

Hello.

Scan (and disinfect, if needed) your PC with Bitdefender Rescue Environment:

https://www.bitdefender.com/consumer/support/answer/29132/

You should also follow the steps from this article:

https://www.bitdefender.com/consumer/support/answer/2574/

Regards.

Flexx

Additionally, follow the steps stated below.

1) Open the Run command and execute the following commands one by one:

temp – delete all the files in the folder.

%temp% – delete all the files in the folder.

prefetch – delete all the files in the folder.

2) Reset your web browsers:

Google Chrome: https://support.google.com/chrome/answer/3296214?hl=en

Mozilla Firefox: https://support.mozilla.org/en-US/kb/refresh-firefox-reset-add-ons-and-settings

Microsoft Edge: https://malwaretips.com/blogs/reset-microsoft-edge/

Opera: https://browsersolution.com/reset-opera-browser

Vivaldi: https://help.vivaldi.com/desktop/install-update/full-reset-of-vivaldi/

Brave: https://support.brave.com/hc/en-us/articles/360017903152-How-do-I-reset-Brave-settings-to-default-

3) Reset the Windows host file to default. You can find instructions here: https://support.microsoft.com/en-us/topic/how-to-reset-the-hosts-file-back-to-the-default-c2a43f9d-e176-c6f3-e4ef-3500277a6dae

4) Run Disk Cleanup using this guide: https://support.microsoft.com/en-us/windows/disk-cleanup-in-windows-8a96ff42-5751-39ad-23d6-434b4d5b9a68

Regards

Alexandru_BD

Hi @Leon2,

I'll add some context to the already helpful remediation steps provided above. This is not exactly something the antivirus would detect in general, and it can happen regardless if you are using a VPN or not.
The notifications and pop-ups in this situation do not have anything malicious attached to them, hence the absence of detection, but when you click on them, or call any contact numbers displayed there, they will redirect to malicious sites that try to collect your data or connect you to scammers who intend to install abusive or dangerous software on your device, claiming there's a "security risk" or other deceptions of the kind.

Bitdefender, or any antivirus for that matter, cannot take any direct measures related to this type of notifications, such as adware that you agreed on or something you enabled, like site setting, site notification, redirects in your browser or installed toolbars, extensions or applications. A browser reset and removing unwanted extensions from it should be enough as these notifications and pop-ups are browser related.

The same happens with the fake virus infection pop-ups which are very common these days and they are also related to adware or various browser extensions that were bundled with other software that the user may have unknowingly installed.

In any case, Bitdefender's defenses would have kicked in the moment you accessed a malicious link from such pop-ups, but it cannot act prior to that, for the reasons explained above.
Technically speaking, the scammers didn't get you. That was a phishing attempt, designed to mislead you into getting in touch with them, and that's when the actual scam takes place, of course. You see, scammers have perfected their methods of deception and they mostly rely on social engineering attacks to trick people into divulging their sensitive information including credit card numbers and login credentials by impersonating a trustworthy entity. Phishing scams are the most efficient attack vector for bad actors to steal sensitive information. Even though attackers have plenty of options, they prefer phishing because it does one thing better than any other method: it tricks victims into partaking in their own attack.

Congratulations on spotting this scam in good time. An antivirus can only do so much, the rest is pure common sense, vigilance and good situational awareness.

I hope my reply brings more clarity on how this happened.

Regards

Alexandru_BD

I have now moved this thread into our Scam Busters category, since it's a good example.

Thanks

Leon2

Thanks for the replies, the recommended steps and the analysis. I've done them.

But, especially a big thank you to Alexandru_BD because this is exactly the type of analysis/response answer I was looking for. I wanted to know the level of exposure (which is none from reading your reply) and that was the biggest question I had, i.e., whether my system had become infected simply because they were able to cause a popup on my screen. I hadn't experienced that either in years or ever but I'm familiar with it since I've seen lots of Youtube videos on scammers using phishing tactics.

Anyway, thank you all for the replies.

Alexandru_BD

You are most welcome @Leon2. I'm glad I managed to shed some light here. 🙂

Have a good day!

AnotherDave

Hopefully this adds some value for people reading and maybe don't already know this - a lot of times with something like what the OP experienced, the "X" and other "buttons" on the screen are not actually buttons at all, but rather, a JPG or GIF or PNG image. Since the beginning of "popups" 27 years ago (popup ads were first introduced to browsers and sites in 1997), bad actors have using a variety of these techniques to trick people into clicking.

So, while I'm not saying that this is the case for @Leon2 and what they encountered, it typically works like this:

The bad guys take a screenshot of a common program prompt, such as a Windows Defender alert or a BitDefender alert etc…. and then they modify the image in a program like Photoshop, to make it say whatever they want it to. They can easily make it look genuine, since anyone can use system fonts and copy official graphics from the UI of any program.

Then, they'll load the image from a "safe" source that wouldn't usually be detected as malicious (such as various cloud storage services and "clean" domain names, so that the image itself in the popup will appear safe and not trigger any security software).

This fake error / alert image will include a scary message and often also a phone number to call, and this will usually cause the intended victim to click the "X" or "No" or "Deny" buttons etc…

Then, the URL embedded in the popup actually links to either a deeper scam or malware download, often using a "multiple redirect" of the URL so that the first one it links to has not yet been detected by the user's security software. This technique, combined with the fact that the bad guys often register brand new domain names every day so that they're not (yet) listed in the bad URL databases of the security software yet.

And by then it's often too late. Unless the user is savvy and has a good understanding of the security suite they use, click… boom… virus downloaded / malicious redirect occurs.

So, virtually any security suite can be temporarily duped if the user used is duped into clicking on anything, and if the bad actor is diligent / determined enough to use this elaborate method to trick them.

A good approach to an encounter like that (disclaimer - this is just how I'd likely handle it, no guarantee that it's the best approach for other people or different types of tricks) might be to:

ALT+F4 to completely close the browser, without clicking anything at all.
Exit/Close any other open programs, and save any work that might have been in progress.
Immediately do a quick scan.
Reboot and run a full set of scans (such as a Bitdefender and also Windows Defender or other supplemental product).
Open NotePad as an admin (right-click on NotePad and choose Run as Administrator) and use it to check the contents of the C:\Windows\System32\drivers\etc\hosts file on the machine, and carefully examine the "localhost name resolution" section. Look for any ip addresses and hostnames that look like they should not be there, and remove them. (You can easily look up ip addresses many different ways, such as abuseipdb.com, to see where they actually exist / what they're affiliated with). If you found a bad ip or hostname in this file, immediately remove it and do another scan / reboot / scan procedure.

I would of course check all my browser settings and exceptions as well, and of course take a look for any Extensions that might have been added / are not recognized.

To some people the above scenario might sound like a lot of work, but it's not, and some people might even think "why would the bad guys go to all this trouble?", and the answers are always the same - it's easy to do and it's either profitable or the bad guy simply enjoys ruining your day. Doesn't have to make sense - this attack vector has existed since 1997 and is out there in full-force on thousands of sites 24/7/365.

I hope someone finds this helpful someday.

Alexandru_BD

@AnotherDave I can say I found this very helpful, thank you very much for sharing! 😏🤜🤛