Windows 10 scam promises free upgrade — avoid this now

News
By published

Email pretends to be from a company IT department

(Image credit: Tom's Guide)

If you're still running Windows 7, then you'd better watch out for a phishing scam that offers to upgrade your computer to Windows 10.

Spotted by information-security firm Cofense, the scam begins with an email from "Genadiy" with the subject line "RE: Microsoft Windows Upgrade." 

"Your Office Windows computer is Outdated and an Upgrade is scheduled for replacement Today," the email message helpfully notes. "To Upgrade your Windows 10, please open your browser to the Windows 10 Upgrade Project Site," followed by a link.

In the body of the email is a table of laptops with serial numbers and locations, plus a list of the benefits you'd get from upgrading: "COVID-19 Employee Symptom Tracker," "Access your pay slips" and "Access the new staff directory," among others.

"This lure needs improvement, but it's not completely awful," Cofense researcher Kaleb Kirk noted in a company blog post. "We give this threat actor two gold stars for the table with made-up laptops, fake serial numbers, building, etc."

All we need is your password, please

Moving right along, the "upgrade" link takes you to a fake Microsoft Outlook login page, where the scamming really begins. The idea is that you're supposed to use your email credentials to authorize this "system upgrade." 

Don't do it! You'd really just be giving your username and password to the scammers so that they can use them to get into your email account. In the past few companies we've worked in, those credentials would also give full access to the corporate network. 

Cofense says that once you input your credentials, the scam site bounces you to a real Microsoft page informing you that, yes indeed, "Support for Windows 7 has ended." (It ended in January 2020.) 

Like the scammers, Microsoft also promises to help you upgrade to Windows 10. Unlike the scammers, it would prefer you pay for the upgrade. (However, there are still legitimate ways to upgrade to Windows 10 for free.)

This scam is clearly designed to target people using Windows 7 on workplace computers, but it's vague enough so that it might snare some home users, too. With millions of people working from home during the COVID-19 pandemic, the line between work and home has gotten pretty blurred anyway.

Paul Wagenseil
Paul Wagenseil

Paul Wagenseil is a senior editor at Tom's Guide focused on security and privacy. He has also been a dishwasher, fry cook, long-haul driver, code monkey and video editor. He's been rooting around in the information-security space for more than 15 years at FoxNews.com, SecurityNewsDaily, TechNewsDaily and Tom's Guide, has presented talks at the ShmooCon, DerbyCon and BSides Las Vegas hacker conferences, shown up in random TV news spots and even moderated a panel discussion at the CEDIA home-technology conference. You can follow his rants on Twitter at @snd_wagenseil.