Translated from the German original. Read the original in German.
My neighbour knows I do “something with computers”. A while ago I stripped back her Windows 11 Home – a system that takes security roughly as seriously as her box-hedge garden fence does – to the point where she could no longer install anything herself.
Or so I thought.
Firefox begged to differ. Thirteen adware extensions, collected over the years like supermarket loyalty stamps, served up advertising – most recently from the red-light end of the market – and finally the classic pop-up: “Your computer is broken. Call Microsoft Support immediately.” A Berlin number.
Panic. Her online banking runs on that computer, and so do her contacts with the grandchildren. In the rush she doesn’t call me but the number on the screen. “I spent four hours on the phone with a Microsoft engineer.”
The scammers get her to start Quick Assist. Fortunately only in “View only” mode – for full control she would have had to click once more. She didn’t. Lucky her.
So the attackers could see everything but control nothing. They had to dictate over the phone what she should type: install VNC via the Run dialog and use hh.exe – Microsoft’s signed help-file viewer – to pull down a script from the internet.
What they hadn’t reckoned with: Caps Lock was on. And when you say “dot” to my neighbour, she reliably types a colon. The result is there in black and white in the registry: HH:EXE WWW:VNCVIEWER:COM WWW:VNCVIEWER:COM MMMMMMMM
The attackers explained, got louder, even explained the Caps Lock key. She carried on typing colons. After four hours the crooks gave up in exasperation and said they would call back the next morning. They didn’t get the chance – the whole thing struck her as odd – and she called me instead.
Forensics (Prefetch, BAM, browser history, registry): no malware. No new service. No new account. Nothing. The dumb clucks came completely unstuck on a Caps Lock key and their inability to dictate a URL to a pensioner.
Even so, the full works: accounts and cards blocked, a criminal complaint filed, passwords changed, the machine wiped and rebuilt from scratch, hardened. Browser extensions are now locked down by policy.
The lesson? Always a standard user, never admin. Lock down browser extensions by policy – they are the way in, not the pop-up.
And a note by the phone: “Microsoft never calls. If something seems odd: hang up and call me.”
The worst part for her, though, was the shame. I spent at least as much time on her peace of mind as on the technology. And to the would-be hackers I wish a case of PTSD called CapsLock.
P.S. For the record, the Berlin phone number: 030 70012323, and the scam campaign: getcubbie.com
