Scammers hijack websites of Bank of America, Netflix, Microsoft, and more to insert fake phone number

Malwarebytes researchers describe a scam campaign in which attackers purchase sponsored search ads and use search-parameter injection to make legitimate brand support pages display the scammers' phone numbers; because the pages and URLs appear genuine, victims are lured into calling and giving personal, financial information or granting remote access. The post documents examples across multiple major brands, explains the reflected-input vulnerability enabling the abuse, highlights detection by Malwarebytes Browser Guard, and offers practical advice for spotting and avoiding these tech-support scams.