The CypherLoc Kit: Advanced Browser-Locking Scareware Campaign
Since the beginning of 2026, threat actors have deployed the CypherLoc Kit, a sophisticated browser-based scareware tool that has orchestrated approximately 2.8 million attacks. The kit leverages intense social engineering by locking a user's web browser and displaying fraudulent, high-pressure Microsoft support alerts designed to funnel victims toward malicious technical support lines. By executing encrypted, environment-aware code directly within the browser, CypherLoc effectively bypasses traditional endpoint security and sandbox analysis that rely on malicious file detection. Organizations must prioritize browser security posture and enhanced user awareness training to mitigate the risks of these highly evasive, non-file-based social engineering campaigns.