StripCall tech-support scam kit

StripCall is an injected JavaScript loader that sends website visitors to a fake Microsoft security-alert support scam. We have matched it on 166 sites since 2 September.

Research by Kirk

StripCall in numbers

Since 2 September, the first StripCall match in our records, counted on 13 October 2026. How we count.

Sites with StripCall code	166
Sites with a match in the last 30 days	131
New sites in September	158
Still serving it when recaptured at least 25 days later	19 of 26 sites (73%)
Sites running WordPress (captured since 25 September)	92%

The loader fetches text and runs it with eval

StripCall sits in a compromised website's HTML. After the document loads, it fetches a remote URL with cache: "no-store", reads the response as text and removes opening and closing script wrappers with a regular expression. It then passes the remaining text to eval(scriptContent).

Retained loaders fetching hxxps://datadock[.]info/plg and hxxps://translatebonus[.]net/usa use the same code and receive the same redirect stage. The endpoint changes while the fetch, strip and execute sequence stays the same.

A random redirect leads to a Microsoft support warning

The stage builds a random subdomain under sslexmo[.]info and a random path. It clicks a hidden link with rel="noreferrer", then calls window.location.replace with the same destination.

The retained chain reaches a page labelled Microsoft Firewall Alert. It claims Microsoft Defender found infected files and asks the visitor to call Windows support. The page and its scripts request full-screen mode, lock the keyboard and pointer, block Escape and refresh, interrupt navigation and play alarm audio.

What we see

Month	New sites
September	158
October so far	8

Among successful captures since 25 September, 45 of 49 StripCall sites ran WordPress. Of the 26 sites recaptured at least 25 days after their first match, 19 still served StripCall (73%).

Checking a StripCall injection

Keep the HTML response and the remote stage it requests. Look for:

a remote fetch with cache: "no-store" inside a document-load handler
response.text() followed by a regular expression that removes script wrappers
eval(scriptContent) immediately after the strip operation
a stage that builds a random sslexmo[.]info subdomain and path
a hidden link click followed by window.location.replace
a fake Microsoft warning with a support number and browser-lock scripts

Remove the loader and restore the changed HTML or template from a trusted copy. Review CMS, hosting and deployment access, rotate affected credentials and clear cached copies of the page.