Fake "Windows Firewall" pop-ups from ads on MSN and other big sites, hosted on Microsoft's own cloud
Ads on sites like MSN and Legacy.com open fake Windows "System Error" pages hosted on Microsoft Azure, with a toll-free number to call.
- Is it a scam?
- Yes, it's a scam. Microsoft didn't send it, even though the web address ends in windows.net, and your computer isn't locked.
- Type
- Fake warning pop-up
- First reported
- November 2, 2026
- Status
- Still active
- Who it targets
- People in the US reading news, reference and webmail sites, mostly on Windows PCs
- Tools it uses
- Microsoft (impersonated), Microsoft Azure
If an ad on a site like MSN, Whitepages or Legacy.com suddenly turned your screen into a "System Error" or "Windows Firewall" warning with a toll-free number to call, it's a scam. Microsoft didn't send it and your computer isn't locked. Close the browser and don't call.
Researchers at the security company PIXM reported this campaign on November 2, 2026. They say the fake warning pages reached people at 80 organizations between March and October 2026, and that new pages were still going up every day when they published.
What does the fake Windows Firewall warning look like?
It starts with an ordinary ad on a website you trust. PIXM found the ads on Whitepages, Legacy.com, Us Weekly, MSN, KMBC, WordHippo, Juno webmail and the health pages of US News & World Report. Those sites didn't do anything wrong. The ads were bought through the automated ad networks that fill space on thousands of websites.
When the ad opens, your browser can go full screen and show what looks like a Windows "System Error" or "Windows Firewall" warning, sometimes with a fake Microsoft Support chat box. Every part of the page points to the same toll-free number. On one page PIXM captured, the browser's normal "press Esc to exit full screen" notice showed up in Chinese.
Why does the web address look like Microsoft?
The pages are hosted on Microsoft's own cloud service, Azure, so the address ends in web.core.windows.net. That makes it look official, but anyone can rent space there. PIXM saw addresses that start with "message" or "viruswarning" followed by numbers and end in z13.web.core.windows.net. A real Windows warning never appears inside a browser tab.
How the scam plays out
PIXM didn't record the phone calls for this campaign. In this type of scam, the person who answers usually says your computer is infected and asks you to install a remote access program, such as AnyDesk or Quick Assist, so they can "fix" it. Then they charge you for a repair you didn't need. Some go on to pretend to be your bank, or offer a fake "refund", to get more money.
How do I close it?
- Don't call the number.
- Press and hold the Escape key for two or three seconds, then close the tab.
- If that doesn't work, press Ctrl + Shift + Esc to open Task Manager, click your browser and choose End task.
- When you open the browser again, don't restore the old tabs.
Restarting the computer is safe too. Nothing has actually been locked.
I already called. What now?
If you're still on the phone, hang up. If you let them connect to your computer, or gave them card or bank details:
- Disconnect the PC from the internet (unplug the cable or turn off Wi-Fi).
- Call your bank from another phone, using the number on the back of your card.
- Change your email password from a different device.
- Uninstall any program they had you install (Settings, then Apps, then Installed apps on Windows 11, or "Apps & features" on Windows 10).
Follow our two-minute checklist for each step, and see what to do after a remote access scam for the days after. You can report it at ReportFraud.ftc.gov and at microsoft.com/reportascam.
How to tell it's fake next time
Microsoft never puts a phone number in a warning, and Windows doesn't show security alerts inside a web page. If a page fills your screen, makes noise and tells you to call, close it, whatever logo it shows and however trusted the site it came from. Our guide to fake Microsoft pop-ups that say "call this number" has more examples.
If a parent tends to get caught by pop-ups like this, Xcelcor Guardian can help with what comes after the call. On a Windows 11 PC it holds any new remote connection (AnyDesk, TeamViewer, Quick Assist and others) until the account holder approves it by email or on xcelcor.com. It doesn't block the pop-up itself.
Phone numbers, messages and files linked to this scam
Web addresses are written with [.] so they can’t be clicked by mistake. If something you received matches, it’s this scam.
What the message or pop-up says
System Error
Name of one fake warning page, as listed by PIXM
Windows Firewall
Name of one fake warning page, as listed by PIXM
若要退出全屏模式，请按 esc
Chrome's "press Esc to exit full screen" notice shown in Chinese on one page PIXM captured on April 3, 2026
Websites
z13[.]web[.]core[.]windows[.]netFake pages sit on random addresses ending like this. PIXM saw names starting message{MMDD}js{NNN} (still live in November) and viruswarning{MMDD}us (March to September)call[.]adhelper[.]ccBehind-the-scenes service that hands each page its phone number (PIXM)adhelper[.]ccScam back end (PIXM)adhelper[.]oneTracker, on registrar hold since October 22, 2026 (PIXM)img[.]czlbb[.]siteSecond tracker (PIXM)
Questions people ask
Is the Windows Firewall pop-up with a phone number real?
No. It's a web page made to look like Windows. Microsoft never puts a phone number in a security warning or asks you to call.
The address ends in windows.net. Isn't that Microsoft?
It's Microsoft's cloud service, but anyone can rent space on it, and these scammers did. A real Windows warning never shows up in a browser tab.
I saw it on MSN or Legacy.com. Was that website hacked?
Researchers say no. The scam came through an ad bought on the automated ad networks that fill space on many big sites. Close the tab and keep using the site as normal.
I called the number and let them connect. What now?
Hang up, disconnect the PC from the internet, and call your bank from another phone using the number on your card. Then follow our checklist.
Sources
Last updated