Anatomy of a Remote-Access Scam

How a single malicious advertisement on a trusted webmail page became a full computer takeover — reconstructed end to end from the machine's own evidence.

Most people picture an online scam as a bad link in a suspicious email. This one began with a legitimate, trusted website and an advertisement served through the same ad networks that fund the mainstream internet. There was no phishing email to not-click. By the time it was over, criminals had installed four separate remote-control tools, disabled the computer's antivirus, taken payment through a card processor, and left a fake "support" icon on the desktop so they could call the victim back.

The victim was a retiree. This is what happened, how we proved every step of it from forensic artifacts, and — importantly — the point where the evidence contradicted our own working theory and we corrected it. All personal details have been removed; the criminal infrastructure is preserved as a warning.

1 · The lure: a malicious ad, not an email

The victim opened their web portal to check email — a routine they performed almost daily. Within about four minutes, a full-screen "your computer is infected" pop-up appeared, displaying a phone number and urging them to call for help. They called. A "technician" answered and directed them to type a remote-support web address by hand.

We were able to prove this was an advertisement, not an email or a clicked link, from the browser's own history:

The remote-support address was typed, with no referring URL — you only type an address like that when someone is reading it to you over the phone. There was no clicked email anywhere in the history (a deleted email's click would still be recorded). And there was no ad URL in the top-level history — which is the signature of a malvertising pop-up rendered inside a sandboxed ad frame. The browser cache confirmed the page was serving programmatic ads through several mainstream ad exchanges. The scam ad rode legitimate ad infrastructure; the trusted site was simply the delivery surface.

2 · The takeover: four remote tools and the "security theater"

Guided by phone, the victim installed remote-control software. Over the session the operators layered in four separate remote-access channels — redundancy so that removing one wouldn't lock them out:

To make the "infection" believable, the operators ran scare theater: opening Windows Event Viewer, system folders, and a normal system process's help page to make routine components look alarming, and directing the victim to uninstall their existing antivirus. They dropped a fake "security suite" onto the desktop — five official-looking executables (FIREWALL.exe, Network Protection.exe, Email Protection.exe, and others) plus a temp-file "cleaner" used to erase traces. We later confirmed the machine's built-in antivirus had been fully disabled (service stopped, real-time protection off, tamper protection off) — which is why the malicious files sat on the desktop unquarantined.

3 · The theft: two money channels

The pretext was a "refund" for a security-subscription overcharge. In reality the victim was walked through two ways to move money to the criminals:

• Retail gift cards, redeemed on the real vendor's redemption page while the operators watched. Because the redemption site is legitimate, no browser warning ever fired. Gift-card value is effectively unrecoverable once redeemed.
• A card payment through a third-party payment processor — a completed card charge, separate from the gift cards. Unlike gift cards, this channel is disputable and traceable: the processor holds "know-your-customer" records on the merchant account behind it, which is a genuine lead for investigators and a chargeback path for the victim.

4 · The hook: engineered for a second hit

5 · The forensics: proving it — and correcting ourselves

The incident was reconstructed to the minute from independent sources: browser history and cache, the remote tools' own session logs, Windows execution artifacts (Prefetch, AppCompat/ShimCache), the registry, event logs, and a filesystem timeline. Every claim in the final report is either artifact-backed or explicitly flagged as pending.

The most important part of the analysis is where it reversed a conclusion. An interim theory held that the operators had logged into the victim's online banking during a remote session — a serious escalation. The remote tool's session log settled it precisely:

The operators had disconnected before the one-time code arrived and before any account data loaded. The banking session was completed by the victim, minutes after the operators left. There was no remote-controlled bank access. A lesser report would have kept the scary version; real forensics follows the evidence, even when it deflates the headline. (What the logs did yield: the operator's own connection IP, geolocating to an overseas ISP — a concrete investigative indicator.)

6 · Indicators & the scam's shape (for recognition)

Victim identifiers are omitted. The pattern below is what repeats across these operations:

7 · What actually protects people

• The lure is an ad on a site you trust — "don't click strange links" doesn't cover it. Teach the reflex: a real security warning never gives you a phone number to call. Close the tab; don't dial.
• No legitimate company asks you to install remote software after an unsolicited alert, buy gift cards, or read back codes.
• Expect a callback. Anyone referencing a prior "technician," a "customer ID," a refund, or "your computer's security" is the scam continuing. Hang up.
• After an incident, containment order matters: secure the email account first (it's the reset path to everything), then dispute the card, then rebuild the machine. Preserve evidence before wiping.