Sponsored messages in the AT&T edition of Yahoo Mail led some readers to a fake Microsoft security alert. The alert told them to call a support number. Our visits from a data center or a phone got a dating or personal finance article instead.
William Vincent, a whack.sh customer, noticed something off about the ads and asked Tuxxin to dig further.
We traced two scam operations through the same ad slot on October 7 and 8, 2026. One of them had also used a Taboola ad on September 24.
The scam kit behind the first ad appears in 747 public scans from July 12 to October 10, the 90 days our search could reach. Those scans cover 536 cloud hostnames and 160 phone numbers.
The technical writeup on whack.sh traces both ad chains hop by hop and lists every indicator.
The ad looked like a new message
The ad sat in the inbox list like an email. Its sender line read "CHECKOUTERS" and its subject read "(1) New Message". A small "Ad" label marked it as sponsored.
Taboola sells the native ads across Yahoo's sites under a 30-year agreement. Yahoo's ad space opened to Taboola advertisers worldwide in October 2023. When it announced the deal in 2022, Taboola said Yahoo reached nearly 900 million monthly users worldwide.
A click on the ad passed through Taboola's click tracker under the publisher ID "yahoo-mail-att". That is the AT&T edition of Yahoo Mail, which serves att.net, sbcglobal.net, bellsouth.net and other AT&T addresses.
In our scans, only Windows desktops on home broadband got the scam
whack.sh, Tuxxin's URL scanner, opens one link from several networks at once and compares what each receives. It scanned the original ad click links that William Vincent sent us.
Windows desktops on home broadband lines at Comcast, Charter and Cox got the scam. One Comcast visit got the scam and the next got the plain article. An Android phone on T-Mobile got a dating article, and a visit from a data center in France got a personal loan article.
The scam only appeared on visits that arrived through a fresh ad click. We opened the first ad's landing page directly eight times. Every visit returned the dating article.
Two operations used the same ad slot
The first ad led to a dating article site that covered itself with a full-screen frame from Microsoft Azure. The frame showed the fake alert while the address bar kept showing the dating site.
The second ad passed through a Branch deep link and a filtering server (TDS) that sorted visitors by network. Our home broadband visit went to a scam page on Azure with a live chat window. The same chat account appeared on another scam page on September 24, reached through a Taboola ad.
The scam kit runs on hundreds of cloud hostnames
The first operation's scam page comes from a kit, a set of files reused on every host. Public scans recorded it on 536 hostnames between July 12 and October 10, 2026, most of them on Microsoft Azure Container Apps. A second review by Kirk of ohey.ca added 31 of those hostnames. The pages listed 160 phone numbers, 126 of them US toll-free numbers.
The kit sends each visitor to a version for their operating system: Windows, macOS, Android or iOS. The Windows version adds a fake locked screen with a Microsoft account sign-in box. Its fields are read-only, and the box points the visitor to the phone number.
When we re-checked the hostnames on October 11, nine still served the kit.
How many people saw the ads
Taboola holds the impression and click counts for both ads. We reported both ad chains to Taboola on October 11, 2026 and requested those counts. No exposure counts have been supplied.
The first ad's tracking link listed a cost of 0.25 per click, with no currency.
Victims reported $1.46 billion in tech support fraud losses in 2024 to the FBI's Internet Crime Complaint Center. People aged 60 and over reported $982 million of that total.
What we reported
The scammers used services from each company below. We sent each one the evidence for its part on October 11, 2026, and filed reports with the FTC and the FBI.
| Recipient | What we sent | Response as of October 11 |
|---|---|---|
| Taboola | Both ad chains, with a request for impression and click counts | Case opened |
| Yahoo | Screenshots and a short alert offering the full report and indicator list. Its form could not take the full report. | Case opened |
| Microsoft Azure abuse portal | The Azure-hosted scam pages. Only the side-by-side capture above could be attached, so the hostname lists were left out. | Submitted, no case number given |
| Microsoft Report Fraud | The Microsoft impersonation and tech support scam | "Your request has been submitted." |
| Branch | The two deep link apps in the ad chains | "Thank you for your feedback!" |
| Tawk.to | The live chat account on the scam pages | "Report received." |
| apiip.net | The API key the scam pages used for location lookups | No reply |
| Vultr | The filtering server (TDS) address and the ad redirect chain | No reply |
| Namecheap | The filtering server (TDS) domain and the ad redirect chain | Case opened |
| Cloudflare Registrar | The ad landing domain, checkouters[.]app | Case opened |
| Cloudflare Trust and Safety | checkouters[.]app, then further context and a list of 13 Cloudflare Workers and Pages hosts running the kit | Said it could not detect abusive or malicious content and asked for more specific information. No reply yet to our follow-ups. |
| Laravel Forge | 34 on-forge[.]com hosts running the kit | Laravel Security said it disabled "the domain in question" and notified the responsible party. The reply did not name the host, and we have not checked the result. |
| REG.RU | The tracker domain and how the scam pages used it | Request opened |
| Stellar Group | The tracker's server | No reply |
| FTC | The scheme and the callback numbers | Report filed |
| FBI IC3 | The ad chains, callback numbers and technical evidence | Complaint filed |
On the evening of October 11, Microsoft Edge showed a phishing warning for checkouters[.]app. When the warning first appeared, and what triggered it, is unknown.
If you saw this alert
Microsoft states that genuine Microsoft error messages never include a phone number to call. Close the browser tab. If the page blocks closing, end the browser in Task Manager on Windows or with Force Quit on a Mac.
If you called the number, uninstall any remote access tool the caller asked you to install. Change your passwords from another device and call your bank if you paid. Report the call at ic3.gov and reportfraud.ftc.gov.
Indicators
Domains are defanged. The whack.sh writeup has the full indicator list, and the 536 kit hostnames are in this CSV file.
- Ad landing page:
checkouters[.]app - Filtering server (TDS):
maizerubyen[.]site - Scam pages:
zingaaf23-4.salmonmushroom-f0512d66.westus2.azurecontainerapps[.]ioandw08win10m844n2491c001.z13.web.core.windows[.]net - Phone numbers: +1 844-959-2491, +1 888-883-5786 and +1 866-949-7055
Drafted with AI assistance.
This report is the original work of Tuxxin LLC, published under Creative Commons Attribution-NoDerivatives 4.0. Media and researchers may quote and republish it with attribution to Daniel Jones, Tuxxin LLC. The inbox screenshot appears with William Vincent's permission and is excluded from the license. For coordinated disclosure: contact@tuxxin.com.