The phone number in the alert did not belong to Microsoft. A quick WHOIS lookup revealed it was a VoIP number routed through a call center in Mumbai.

But five minutes later, your screen explodes.

“Hello, Microsoft Support. We have detected an IDM-related breach on your network.”

IDM integrates itself deeply into your browser and system. It injects DLLs (Dynamic Link Libraries) into your web browsers, monitors clipboard data, and hooks into low-level network traffic. This is not malware; this is how it works. But to an antivirus program, this behavior looks suspiciously like a rootkit.

When you call the number on the fake IDM alert, you are not connected to Microsoft. You are connected to a boiler room. The person on the other end has a heavy accent, a script, and a remote access tool like AnyDesk or TeamViewer ready to go.