SysScan Fake AV Scam Network + RecruitTrap Mobile Credential Phishing: OTX Pulse Analysis — Enterprise Detection Pack

Two distinct but complementary social-engineering campaigns surfaced in OTX telemetry on 2026-08-25, and together they paint a coherent picture of how commodity threat actors are defeating enterprise defenses without exploiting a single vulnerability: they convince the victim to do the work.

Campaign 1 — SysScan Fake Security Scan Network. A network of eleven fraudulent websites branded as "SysScan," dressed with Microsoft logos and hosted on a single server, runs fabricated security scans built from basic browser fingerprint data. The scoring engine is deliberately rigged to return results between 13 and 30 out of 100 — a guaranteed failure state designed to induce panic. Victims are then walked through uninstalling their legitimate antivirus software, after which the operation pivots into tech-support/refund fraud and remote-access tooling installation, with Telegram used as the exfiltration and operator-communication channel. This is defense evasion by persuasion: the endpoint protection stack is removed by the user, not by the malware.

Campaign 2 — RecruitTrap Recruitment Phishing. Threat actors impersonating HR personnel from prominent brands (McKinsey, FIFA, Expedia, Levi's, American Airlines, HBC, and others) are targeting enterprise credentials with recruitment-themed lures. The operation is technically disciplined: on desktop it uses Browser-in-the-Browser (BitB) windows to render pixel-perfect fake SSO login panels; on mobile it serves full-screen counterfeit login pages with no visible URL bar. Infrastructure actively gates victims — personal email addresses are rejected, indicating a deliberate focus on corporate credential capture, including OAuth tokens. Targeted verticals include aerospace, technology, retail, finance, hospitality, manufacturing, and media.

Collective assessment. Both campaigns attack the same kill-chain position from opposite ends: SysScan strips detection capability (AV removal), while RecruitTrap harvests the identity layer (credentials + OAuth tokens). An organization hit by both would have blinded endpoints and compromised identities simultaneously — a pre-positioning pattern consistent with intrusion-as-a-service brokers preparing access for resale.

Threat Actor / Malware Profile

Neither campaign is attributed to a named actor (TLP:WHITE, adversary unknown), which is typical of crimeware-for-hire infrastructure. Behavioral profiles:

SysScan (Tech Support Fraud / Defense-Evasion-as-a-Service)

• Distribution: SEO poisoning, malvertising, and scareware redirects funneling victims to lookalike scanner domains (detectsysscanner., detsysscanner., techsysscanner.*, tlcscanner.com).
• Payload behavior: No malware is dropped initially. The fake scan runs entirely in-browser using navigator/userAgent fingerprinting, then delivers scripted social engineering that instructs the victim to uninstall AV and grant remote access (typically legitimate RMM tools like AnyDesk/TeamViewer abused as access implants).
• C2 / exfiltration: Telegram Bot API (api.telegram.org) for operator comms and victim-data exfiltration — encrypted, low-cost, and blending with legitimate traffic.
• Persistence: Achieved via installed RMM tooling rather than traditional implants; refund-scam recontact lists sustain the operation.
• Anti-analysis: Domain rotation across multiple TLDs (.at, .com, .de, .lol), typosquat variants (detsysscanner), and scores hard-coded to always fail regardless of actual system state.

RecruitTrap (Enterprise Credential Harvester)

• Distribution: Spear-phishing recruitment lures impersonating corporate HR via email and likely LinkedIn/job-board channels, directing victims to *-careers.com lookalike domains.
• Payload behavior: Browser-in-the-Browser fake SSO windows on desktop; full-screen mobile login clones with no URL visibility. Victim screening rejects personal (gmail/outlook/yahoo) addresses to keep the credential pool enterprise-grade.
• C2 / exfiltration: Credential and OAuth token capture on adversary-controlled domains; token theft enables MFA-resistant session replay.
• Persistence: Stolen OAuth consent grants and session tokens can persist beyond password resets if tokens are not revoked.
• Anti-analysis: Victim gating/filtering logic, mobile-vs-desktop fingerprint-aware delivery, and brand-impersonation domain churn.

IOC Analysis

All indicators in these pulses are domain-type IOCs — no IPs, hashes, or URLs were published, which is characteristic of fast-flux social-engineering infrastructure where domains are disposable and payloads are server-side.

SysScan cluster (8 domains): detectsysscanner.at/.com/.de, detsysscanner.com/.de, techsysscanner.com/.lol, tlcscanner.com. The clustering on a single host means one resolved IP likely covers the whole set — resolving these domains and blocking at the IP layer yields outsized defensive value.

RecruitTrap cluster (8 domains): hbc-careers.com, fifahr-careers.com, mckinsey-careers.com, aa-careers.com, levis-careers.com, andmore-global.com, careers.com, expedia-careers.com. The brand-careers.com naming pattern is itself a detection heuristic — alerting on any new domain matching your own brand + careers/hr/jobs suffix is durable against rotation.

Operationalization guidance for SOC teams:

• Ingest all 16 domains into your DNS sinkhole, secure web gateway, and EDR network blocklists immediately. Set TTL on blocks to 90 days minimum — these operators re-register.
• Passive DNS expansion: query your passive DNS provider (or internal resolver logs) for the SysScan server IP, then hunt all domains historically co-hosted there — the published 8 are a sample of the full set.
• For RecruitTrap, domain blocking alone is insufficient because OAuth tokens may already be captured. Cross-reference any outbound connection to these domains against identity logs to determine who submitted credentials.
• Tooling: urlscan.io and VirusTotal for live rendering/screenshot verification of the BitB pages; OTX DirectConnect or the OTXv2 API for automated pulse ingestion; dnstwist for proactive registration monitoring of your own brand permutations.

Detection Engineering

---
title: Antivirus Uninstall Attempt via Command Line (SysScan Social Engineering)
id: 9f3a2c11-7b4e-4d6a-9e21-sysscan000001
status: experimental
description: Detects command-line attempts to uninstall or disable endpoint security products, consistent with SysScan fake-scan scams that socially engineer victims into removing antivirus before remote-access fraud.
author: Security Arsenal Threat Intel
references:
  - https://www.malwarebytes.com/blog/threat-intel/2026/08/fake-microsoft-security-scans-trick-victims-into-uninstalling-their-antivirus
date: 2026/08/25
logsource:
  category: process_creation
  product: windows
detection:
  selection_uninstaller:
    Image|endswith:
      - '\msiexec.exe'
      - '\wmic.exe'
      - '\powershell.exe'
      - '\cmd.exe'
  selection_flags:
    CommandLine|contains:
      - ' /x'
      - 'uninstall'
      - 'product where name='
      - 'Set-MpPreference -DisableRealtimeMonitoring'
  selection_av_products:
    CommandLine|contains:
      - 'Defender'
      - 'CrowdStrike'
      - 'SentinelOne'
      - 'Sophos'
      - 'Malwarebytes'
      - 'Symantec'
      - 'McAfee'
      - 'ESET'
  condition: selection_uninstaller and selection_flags and selection_av_products
falsepositives:
  - Legitimate IT software migration or AV replacement performed by administrators
level: high
tags:
  - attack.defense_evasion
  - attack.t1562.001
---
title: Outbound Connection to SysScan or RecruitTrap Phishing Infrastructure
id: 9f3a2c11-7b4e-4d6a-9e21-recruit00002
status: experimental
description: Detects DNS/network connections to known SysScan fake-scanner domains and RecruitTrap recruitment-phishing domains from OTX pulse data 2026-08-25.
author: Security Arsenal Threat Intel
references:
  - https://zimperium.com/blog/extended-rapid-response-zimperium-identifies-recruittrap-recruit-scams-are-targeting-enterprise-credentials-on-mobile
date: 2026/08/25
logsource:
  category: dns
  product: windows
detection:
  selection:
    query|contains:
      - 'detectsysscanner'
      - 'detsysscanner'
      - 'techsysscanner'
      - 'tlcscanner.com'
      - 'hbc-careers.com'
      - 'fifahr-careers.com'
      - 'mckinsey-careers.com'
      - 'aa-careers.com'
      - 'levis-careers.com'
      - 'andmore-global.com'
      - 'expedia-careers.com'
  condition: selection
falsepositives:
  - Threat research and sandbox detonation
level: critical
tags:
  - attack.initial_access
  - attack.t1566.002
---
title: Telegram Bot API Exfiltration from Non-Browser Process
id: 9f3a2c11-7b4e-4d6a-9e21-telegr000003
status: experimental
description: Detects processes other than browsers or the Telegram client communicating with the Telegram Bot API, consistent with SysScan operator exfiltration and commodity infostealer C2 channels.
author: Security Arsenal Threat Intel
date: 2026/08/25
logsource:
  category: network_connection
  product: windows
detection:
  selection_dest:
    DestinationHostname|contains:
      - 'api.telegram.org'
  filter_legit:
    Image|endswith:
      - '\Telegram.exe'
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\opera.exe'
  condition: selection_dest and not filter_legit
falsepositives:
  - Custom internal tooling using Telegram notifications
level: high
tags:
  - attack.exfiltration
  - attack.t1102
  - attack.t1567

// RecruitTrap + SysScan: correlate phishing-domain connections with identity exposure and AV tampering
let phishingDomains = dynamic(["detectsysscanner.at","detectsysscanner.com","detectsysscanner.de","detsysscanner.com","detsysscanner.de","techsysscanner.com","techsysscanner.lol","tlcscanner.com","hbc-careers.com","fifahr-careers.com","mckinsey-careers.com","aa-careers.com","levis-careers.com","andmore-global.com","careers.com","expedia-careers.com"]);
let hits = DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any (phishingDomains)
| project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine;
let avTamper = DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where ProcessCommandLine has_any (" /x", "uninstall", "Set-MpPreference", "DisableRealtimeMonitoring")
  and ProcessCommandLine has_any ("Defender","CrowdStrike","SentinelOne","Sophos","Malwarebytes","Symantec","McAfee","ESET")
| project AvTamperTime=TimeGenerated, DeviceName, AccountName, TamperCmd=ProcessCommandLine;
hits
| join kind=leftouter avTamper on DeviceName
| where isnull(AvTamperTime) or AvTamperTime between (TimeGenerated .. TimeGenerated + 4h)
| extend Priority = iff(isnotnull(AvTamperTime), "CRITICAL - Defense evasion after phishing contact", "High - Phishing infrastructure contact")
| sort by TimeGenerated desc

# Security Arsenal — SysScan / RecruitTrap IOC Hunt Script
# Checks DNS cache, hosts file, running RMM tools, AV status, and recent AV uninstall events
$ErrorActionPreference = 'SilentlyContinue'

$badDomains = @("detectsysscanner.at","detectsysscanner.com","detectsysscanner.de","detsysscanner.com","detsysscanner.de","techsysscanner.com","techsysscanner.lol","tlcscanner.com","hbc-careers.com","fifahr-careers.com","mckinsey-careers.com","aa-careers.com","levis-careers.com","andmore-global.com","expedia-careers.com")

Write-Host "=== [1] DNS Cache Lookup for Phishing Domains ===" -ForegroundColor Cyan
$dnsCache = Get-DnsClientCache
foreach ($d in $badDomains) {
    $m = $dnsCache | Where-Object { $_.Entry -like "*$d*" }
    if ($m) { Write-Host "[HIT] DNS cache contains $d -> $($m.Data -join ', ')" -ForegroundColor Red }
}

Write-Host "`n=== [2] Active Connections to api.telegram.org (non-browser) ===" -ForegroundColor Cyan
Get-NetTCPConnection -State Established | ForEach-Object {
    $ip = $_.RemoteAddress
    $proc = Get-Process -Id $_.OwningProcess
    try {
        $rdns = ([System.Net.Dns]::GetHostEntry($ip)).HostName
        if ($rdns -like "*telegram*") {
            Write-Host "[HIT] Telegram API conn from $($proc.ProcessName) (PID $($_.OwningProcess)) -> $ip ($rdns)" -ForegroundColor Red
        }
    } catch {}
}

Write-Host "`n=== [3] Suspicious RMM / Remote Access Tools Installed ===" -ForegroundColor Cyan
$rmmTools = @("AnyDesk","TeamViewer","UltraViewer","RustDesk","Ammyy","ScreenConnect","ConnectWise","Zoho Assist","Splashtop")
$uninstallKeys = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*","HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*","HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*")
foreach ($key in $uninstallKeys) {
    Get-ItemProperty $key | ForEach-Object {
        foreach ($tool in $rmmTools) {
            if ($_.DisplayName -like "*$tool*") {
                Write-Host "[REVIEW] RMM installed: $($_.DisplayName) | Installed: $($_.InstallDate)" -ForegroundColor Yellow
            }
        }
    }
}

Write-Host "`n=== [4] Antivirus Health / Tampering Check ===" -ForegroundColor Cyan
Get-MpComputerStatus | Select-Object AntivirusEnabled, RealTimeProtectionEnabled, AMServiceEnabled | Format-List
if ((Get-MpComputerStatus).RealTimeProtectionEnabled -eq $false) {
    Write-Host "[HIT] Defender Real-Time Protection DISABLED — possible SysScan-style tampering" -ForegroundColor Red
}

Write-Host "`n=== [5] Recent AV/Security Product Uninstall Events (last 7 days) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Application'; Id=11724; StartTime=(Get-Date).AddDays(-7)} | ForEach-Object {
    if ($_.Message -match "Defender|CrowdStrike|SentinelOne|Sophos|Malwarebytes|Symantec|McAfee|ESET") {
        Write-Host "[HIT] Security product removed: $($_.TimeCreated) :: $($_.Message.Substring(0,[Math]::Min(160,$_.Message.Length)))" -ForegroundColor Red
    }
}

Write-Host "`n=== Hunt complete. Escalate any [HIT] findings per IR runbook. ===" -ForegroundColor Green

Response Priorities

Immediate (0-4h):

• Block all 16 domains at DNS, secure web gateway, and EDR network layers; resolve SysScan domains and block the shared hosting IP.
• Run the KQL hunt to identify any endpoint that contacted the infrastructure in the past 7 days; flag for user interview.
• Query passive DNS for co-hosted domains on the SysScan server and preemptively block the expanded set.

24 Hours:

• For any user who visited a RecruitTrap domain: force password reset AND revoke all OAuth grants, refresh tokens, and active sessions — token theft survives password changes.
• Audit that user's sign-in logs (Entra ID / Okta) for anomalous session replay from new geographies or impossible travel.
• For any endpoint showing AV uninstall events: treat as compromised, isolate, and check for installed RMM tooling (AnyDesk, TeamViewer, UltraViewer) as the persistence mechanism.
• Check for outbound Telegram Bot API traffic from non-browser processes fleet-wide.

1 Week:

• Deploy the Sigma rules into production detection; tune the AV-uninstall rule against admin migration activity.
• Implement tamper protection enforcement (Defender Tamper Protection, or equivalent EDR lockdown) so AV removal requires admin credentials a help-desk scammer can't socially engineer around.
• Stand up brand-permutation domain monitoring (dnstwist or commercial equivalent) for yourbrand-careers/hr/jobs patterns — RecruitTrap rotates impersonation targets.
• Move high-risk users to phishing-resistant MFA (FIDO2/passkeys) — RecruitTrap's OAuth-token capture defeats push-based and OTP MFA.
• Launch a targeted awareness module on fake security scans and recruitment lures, specifically covering the "never uninstall security software at the direction of a website or caller" rule.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub