The Scam Call Has Gotten Professional
PCRescue newsletter, October 2026.
I've been doing this long enough to remember when a tech support scam was one guy with a bad accent and a script. You could hear it a mile away. That's not what I'm seeing anymore.
What I'm seeing now looks like a business. These scams are put together and run by boiler-room operations, the same kind of call-center setups that used to sell fake timeshares. There's a script, there are people working shifts, and there are different people for different jobs. One person makes the call and gets you on the line. Someone else takes over once they're in. And there's a cleanup crew whose whole job is making sure they can't be kicked out.
I say that because of what I found on a computer last week, and I want to tell you the story.
The phone call
A client of mine (I've changed the details, but not the attack) got a call about a problem with her computer. The caller was polite, patient, and sounded like he'd done this a thousand times. Which, I suspect, he had. He asked her to let him connect so he could fix it. She said yes, and for about half an hour a stranger drove her computer while she watched.
Nothing was hacked. She was led to open the door herself.
Which is how it always starts.
What's new is everything they did after she opened it.
What I found
When she called me, nothing looked broken. But she had a bad feeling, and she was right to.
Looking at the Windows Event Viewer, I could see what was installed and what actions were taken from the moment they accessed her computer.
The first thing I found was ScreenConnect. That's a real remote support program, one that many technicians (including myself) use, which is exactly why the attackers like it. But there wasn't one copy. There were several. If I removed one, another was sitting there ready to let them back in. Even if I uninstalled them all, it wouldn't be enough.
They had put installers in her OneDrive, and they had added scheduled tasks to Windows to run those installers if a copy ever went missing. So if I deleted the program, a little while later it would come right back. Someone had thought about what a technician like me would do, and planned for it.
They also took care of her email. Certain messages, the kind that might have tipped her off, like security alerts and account notices, never reached her inbox. They were kept out of sight and forwarded to the attackers. So she saw nothing unusual while they read everything.
And they went after her passwords. They exported the saved password lists from Google Chrome, Microsoft Edge, and Firefox and dropped it into her OneDrive. Since they had access to her OneDrive, they could pick it up whenever they wanted.
I removed the tasks, the registry entries, and the remote software with the computer disconnected from the internet. The client changed her email and disabled the mail forwarding from a different computer. Chrome, Microsoft, and Firefox profile passwords were next. Then I instructed her to change every password that had been captured from her computer, freeze her credit, and comb through accounts looking for charges she did not recognize.
The Scary Part
Every step leveraged normal features. Remote support software, OneDrive, Window's tasks, Chrome's password export. No virus, so antivirus stays quiet. It takes a person who knows where to look; the event viewer, the registry, the task manager.
That's the sophistication I keep coming back to. Not clever code, but a crew that has done this enough times to have a checklist: get in, make sure you can't be removed, hide the warnings, take the keys.
What to Take Away From This
- Real companies don't call you about your computer. Not Microsoft, not your internet provider, not your bank.
- Only let someone connect remotely if you started the contact. If you called me, great. If someone called you out of the blue, hang up.
- If it already happened, don't just uninstall the program. There's probably more than one way back in.
- Change your passwords from a different, clean computer, and think twice about saving them in your browser. A password manager is much safer, and I'm happy to help you set one up.
If you think someone has been on your computer and you're not sure what they did, call me right away. Every day gives them more time.
— Mike, PCRescue