Are there any Action Scams in Microsoft Defender

Question

Are there any Action Scams in Microsoft Defender

Bernie Connelly 0

I have a user who has sent me an email as to whether a pop up window informing them of Malware and giving them a button to Start Actions

Rukmini 43,995 Reputation points Microsoft External Staff Moderator

2026-02-02T16:14:48.3566667+00:00
Hey Bernie! It sounds like your user received a popup message indicating malware and a button to start actions, and you're wondering if this is related to any scams involving Microsoft Defender.

In general, Microsoft Defender for Cloud does have capabilities to detect malware and generate security alerts when threats are identified. These alerts can provide users with information about the detected threat and possible remediation steps. If your user is seeing a popup that prompts them to take immediate actions regarding malware, it’s crucial to determine whether this is a legitimate alert from Defender or potentially a phishing attempt or ad for a third-party product.

Here's what you can advise your user:

Verify the Source: Check if the popup is coming from the legitimate Microsoft Defender for Cloud application or if it appears to be from a browser or a different application. Legitimate alerts will usually come directly through the Microsoft Defender interface.

Avoid Clicking on Unfamiliar Links: If they’re unsure, advise them not to click any buttons in the popup and to close the window. They should open Microsoft Defender for Cloud from the actual application or Azure portal to check for any alerts directly.

Access Security Alerts: Guide them to navigate to the Azure portal and check under Microsoft Defender for Cloud > Security alerts to see if there are any legitimate alerts regarding malware.

Run a Security Scan: It may help to run a manual scan through Microsoft Defender for Cloud to ensure there are no actual threats present.

Submit Potential False Positives: If they believe it was a legitimate alert and thought it was a false positive, you can guide them on how to submit it for analysis.

For further insights, you might find these resources helpful:

Malware scanning in Microsoft Defender for Cloud

Submit files for analysis with Microsoft Defender

Follow-Up Questions

To help you better, could you please clarify:

What exactly does the popup window say?

Does it appear within an application, or does it show up in a web browser?

Has your user checked the Azure portal for any alerts in Microsoft Defender for Cloud?

Hope this helps you troubleshoot the issue! Let me know if you need further assistance!

Note: This content was drafted with the help of an AI system. Please verify the information before relying on it for decision-making.
VEMULA SRISAI 14,065 Reputation points Microsoft External Staff Moderator

2026-02-23T11:26:03.5433333+00:00

Bernie Connelly could you please the comment by Rukmini and let us know if you need any additional information or further assistance.

1 answer

Your answer

VEMULA SRISAI 14,065 Reputation points Microsoft External Staff Moderator

2026-02-23T11:26:03.5433333+00:00

Bernie Connelly could you please the comment by Rukmini and let us know if you need any additional information or further assistance.

Answer 1

It appears that the pop-up window your user encountered may be a tech support scam rather than a legitimate alert from Microsoft Defender. Microsoft does not send unsolicited pop-up messages or emails requesting personal information or prompting users to take immediate action regarding malware. Here are some key points to consider:

Legitimacy of the Pop-Up: Microsoft’s error messages do not include phone numbers or buttons to start actions. If the pop-up instructs the user to click a button to start actions, it is likely a scam.
Recommended Actions: Advise the user not to click any buttons in the pop-up. They should close the window and run a full scan with Microsoft Defender Antivirus to check for any malware.
Reporting: If the user believes they have encountered a scam, they can report it to Microsoft through their official channels.

It's essential to educate users about recognizing such scams and to ensure they are cautious when interacting with unexpected pop-ups or emails.