New 3 Step Malvertising Chain Abusing Facebook Paid Ads to Push Tech Support Scam Kit

A malvertising campaign on Facebook delivers paid ads that redirect victims via a decoy Italian-restaurant site to fraudulent landing pages hosted on Microsoft Azure (e.g., web.core.windows.net). The final pages display fake system warnings to coerce users into calling a scam support hotline; operators rotate over 100 domains in seven days, focus on U.S. users during weekdays, and leverage legitimate cloud infrastructure to evade blocking and signature-based detection.