Suspicious Login Issues

What to Do If a Fake Microsoft Support Agent Runs Malware

Olivia Miller Oct 21, 2026 868 views

Question details

A user suspects they interacted with a technical support impersonator claiming to be from Microsoft, who instructed them to run a suspicious script configuring an external KMS server.

What to Do If a Fake Microsoft Support Agent Runs Malware or Piracy Code

Product: Microsoft Office
Device & OS: not provided
Scenario: Seeking technical support or attempting to activate Microsoft Office and encountering a fraudulent support agent.
Observed behavior: The fake agent asks the user to run a script that uses an unauthorized product key, configures an external KMS server, or promotes software piracy.

Before you start

Immediately disconnect your computer from the internet by unplugging your Ethernet cable or disabling Wi-Fi to prevent the scammer from maintaining remote access or exfiltrating your data.

Solution 1Recommended

Secure Your Computer and Remove Malicious Scripts

Use this method to sever the attacker's connection and clean unauthorized software or KMS scripts from your system.

A genuine Microsoft agent will never ask you to run a script that uses an external KMS server or an unauthorized product key. If you ran such a script, you must assume your device is compromised.

Stop the malicious script

If the script or command prompt window is currently open on your screen, click the 'X' in the top right corner to close it immediately. Do not press any further keys or authorize administrator prompts.

Run a full security scan

Open Windows Security by clicking the shield icon in your taskbar. Navigate to 'Virus & threat protection', click 'Scan options', select 'Full scan', and click 'Scan now' to detect and remove the unauthorized software.

Change your passwords securely

Using a completely different, known-clean device (like your smartphone), change the passwords for your Microsoft account, email, and any financial institutions you accessed recently.

Important Security Precaution: Do not attempt to change your passwords on the compromised machine, as the scammer may have installed a keylogger to capture your new credentials.

Solution 2

Report the Incident to Official Channels

Take action to report the impersonation scam and seek legitimate assistance if your Office activation is broken.

Free Microsoft Office alternative

Avoid Activation Scams with WPS Office

Tired of complicated activations and potential KMS scams? Switch to WPS Office for a safe, secure, and hassle-free productivity experience. It is fully equipped to handle your document needs without the risk of unauthorized third-party scripts.

1. Download the official installer: Visit the official WPS Office website to download the secure, verified installation package.
2. Install WPS Office: Run the installer and follow the on-screen prompts to set up the software safely on your computer.
3. Open and edit your files seamlessly: Launch WPS Office to immediately open, edit, and save your existing Microsoft Office documents without formatting loss.

Highly compatible with Microsoft Word, Excel, and PowerPoint formats.No complex activation scripts or external KMS servers required.Free, lightweight, and incredibly easy to install and use.Familiar user interface ensuring seamless migration from Microsoft Office.

Frequently Asked Questions

How can I tell if a Microsoft Support agent is fake?

Genuine Microsoft agents will never ask you to run scripts that configure external KMS servers, use unauthorized product keys, or request payment via gift cards or crypto. Official support is only conducted through verified Microsoft channels.

What should I do if the scammer still has remote access to my PC?

Immediately sever the internet connection by unplugging your Ethernet cable or disabling your Wi-Fi router. Then, uninstall any remote access software (like AnyDesk or TeamViewer) from the 'Apps & Features' menu in Windows Settings.

Is it safe to use my computer after running a malicious KMS script?

Not until you have performed a comprehensive malware scan. Run a full scan using Microsoft Defender or another reputable antivirus program to ensure all malicious files and backdoors are completely removed.

Microsoft Office Security Issues