Fake Microsoft security scans trick victims into uninstalling their antivirus

A set of malicious websites impersonating a Microsoft 'SysScan' service run fake browser-based security scans that always show failures, instruct victims to uninstall antivirus and install remote-access tools, and collect personal, banking, and remote-access credentials which are sent to the attackers (via the Telegram bot API). The report analyzes the scam's technical behavior, shows sample IOCs (hosting IP and multiple domains), explains why the checks are fraudulent, and provides remediation and reporting guidance for affected users.