(Credit: Postmodern Studio/Shutterstock.com)
Just because a website appears at the top of Google's search results doesn't mean the site is legit—or safe.
Scammers are spinning up fake Disney+ sites that rank on Google but redirect victims to malicious web pages, Malwarebytes has found. The goal is to gain access to your computer and steal your money by getting you to call a fake customer support phone line.
The fake Disney+ site redirects users to another site hosted on Microsoft Azure, with the goal of making the Microsoft-branded pop-ups seem real (they're not). Victims then see a blurred-out Pornhub site intended to trick users into thinking that Microsoft's Windows Defender "caught" Trojan spyware and child pornography on their computer.
"Alureon Spyware With Child Pornography Download Detected," the fake Microsoft message reads. The malicious pop-ups urge victims to call a 1-833 number claiming to be a "Security Helpline." Scammers can buy phone numbers that start with 833 for as little as $20 a month.
Once a victim calls the fake support line, they may be tricked into letting the cybercriminals into their PC, who may then attempt to withdraw money from the victims' bank accounts.
"Scammers are typically getting users to download a remote desktop application either on mobile or their computer, while on the phone," Malwarebytes Senior Director of Research Jérôme Segura tells PCMag via email. "Given the position in Google's ranking, I'd expect a number of people have visited those websites, with at least a small number of them being defrauded."
Searching for "Disney plus begin" or "Disney activation code" brings up the malicious site within the top few Google Search results at time of writing. There's also a questionable-looking GitHub repository with similar "Disney Plus begins" phrasing in its URL.
"I've seen a few other domains also impersonating Disney+. Not all are necessarily malicious, but they are trying to monetize via dubious surveys or forced Google ads," Segura explains.
Malwarebytes previously found that cybercriminals have used malicious GitHub repos to host fake Apple Customer Service pages that lure victims into calling yet another scammer's phone number. Considering this, any Disney+ GitHub repo could be part of a scam.
Scams that try to scare internet users by suggesting they have porn or child pornography on their computer have been around for a while, as have email scams where attackers pretend they've got some wild photos or videos of you (they don't).
More broadly, fake customer support phone scams have been a problem for years and can be designed to trick Windows, Apple, and Android users. They'll impersonate just about any big tech firm, including Amazon, to get you to trust them. Like most online scams, they're crafted to confuse or scare the victim into feeling the situation is urgent, so that they won't take a moment to think over whether something could be an elaborate scam. When the victim panics, scammers hope this will help lead victims into quickly handing over personal information or access to their computer (or ask them to pay money) to "solve" the "problem."
To avoid phone support scams, it's best to be careful about what links you click on when using search engines and to avoid links with typos, lots of hyphens, or irregular domain extensions. You can check links before clicking on them by using free link checkers like NordVPN's, which flags the fake porn page with Windows pop-ups as a malware site.
You can also install browser extensions that block malicious sites, like Malwarebytes' Browser Guard Chrome extension or AdGuard, or go for antivirus software with real-time protection.