Hackers Use CypherLoc Kit to Push Fake Microsoft Support Scams

Gbhackers •Mayura Kathir • May 25, 2026

CypherLoc is a sophisticated browser-lock scareware designed to drive victims to fraudulent tech support calls. It evades scanners and sandboxes by executing in an encrypted, condition-based manner inside the browser. Security teams should have robust anti-phishing, browser, and endpoint protections and prioritize user education. Since the start of 2026, Barracuda researchers have observed around 2.8 million […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CypherLoc Scareware Targets Users with Fake Microsoft Support Scams A new scareware kit named CypherLoc is being used by hackers to lock victims' browsers and direct them to fraudulent Microsoft support lines. This browser-locking scareware has been linked to approximately 2.8 million attacks since the beginning of 2026. CypherLoc operates in an encrypted manner, making it difficult for traditional security tools to detect. Security experts emphasize the need for robust anti-phishing and endpoint protections, as well as user education to combat this threat. The kit represents a significant escalation in browser-based attacks, posing risks to a wide range of internet users. Organizations are advised to implement stronger security measures to mitigate the impact of such threats. 4 sources 68

Extracted Entities

Hackers Use CypherLoc Kit to Push Fake Microsoft Support Scams

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (1)