Yahoo Mail served malvertising with fake Microsoft security alert

On October 7–8, 2026, two scam campaigns ran in the same sponsored slot of AT&T's Yahoo Mail, showing a fake Microsoft security alert with a toll-free number only to Windows desktops on home broadband. Clicks passed through Taboola's tracker, a Branch deep link and a filtering server, with scam pages hosted on Azure.

• The scam appeared only to Windows desktops on home broadband; phones and data centers saw normal articles
• First chain led to checkouters.app with an Azure frame and the number +1 888-883-5786
• Second chain passed through a Branch link and maizerubyen.site to Azure with +1 844-959-2491
• The scam kit appeared in 747 public urlscan scans from July 12 to October 10, 2026