Unfortunately, the Scammer Was Very Helpful

The helpful part can be real

Your browser is shouting that something is wrong. Someone on the phone helps make it stop. Lovely. Finally, a person who knows what they are doing.

Then comes a new request: install this remote-support tool.

That is the important turn in Infoblox's Help TDS investigation. During a mid-June 2026 test call, a person claiming to be Microsoft support helped clear the fake warning, then asked the researchers to download UltraViewer. They questioned the request, and the call ended.

UltraViewer is real remote-support software. The issue is not that every use of it is malicious. It is that removing an interruption does not establish who the caller is or why they should control your computer. The October report does not show completed theft in that test call.

Thanks for removing the boot. You still cannot have the keys.

Imagine someone clamps a boot onto your car and leaves a roadside-assistance number. You call. They remove the boot for free, then ask for your keys to take the car on a little test drive.

Generous service, considering how the problem started.

That is Connor's analogy, not a second reported incident. It separates two questions that can get bundled together: did this person help, and should this person get more access?

Why the sigh of relief deserves a pause

Fear-then-relief describes a pattern studied by Doliński and Nawrat in 1998: a sudden release from anxiety can increase agreement with a subsequent request under some conditions.

In one field comparison, a leaflet under a car's wiper initially resembled a parking ticket but turned out to be an advertisement. Afterward, a researcher asked the driver to complete a traffic questionnaire. The author's later account describes greater agreement in the fear-then-relief condition than in the comparison conditions.

That experiment did not test this scam. It cannot tell us what a particular person felt or why they agreed. It gives us a useful question: does this next request make sense, or am I just relieved the previous problem is over?

Give the next request a fresh check

Microsoft says its genuine error messages do not include support phone numbers. Do not call the number in the warning or use its contact links. Close the browser, force-quit if necessary, and find support through a route you already trust. On a work device, use your usual IT contact.

If you already installed software, shared credentials, or allowed remote access, the response is different. Contact trusted support or work IT and explain what happened. Removing software, checking the device, and securing affected accounts may be needed. A vanished pop-up is not evidence that access has ended.

You can appreciate help without handing over the keys.