Thread by @NanoBaiter

1/ Meet Sushil Chouhan, An Indian national who owns a scam call center in New Delhi, India. He has been scamming thousands of innocent people since November 2023.

2/ I first encountered Sushil's operation when I came across this "Microsoft scam popup." It blocked my keyboard and mouse input and played an audible warning instructing me to call a toll-free number. (This is an example of the scam popup.) Don't call the number!

3/ When I called this toll-free number, I got connected to what sounded like a busy office. The person answering the phone introduced himself as a "Microsoft Certified technician." He told me that my computer was infected with a trojan virus and that I needed to connect it to a "secure server" (remote access software).

4/ After the scammer gained access to my virtual machine, he started the scam by showing me non-existent issues (Event Viewer) and stopped services. Once he finished the initial scam pitch, he opened a notepad file and wrote out the so-called "Support plans."

5/ The scammer thought everything was going his way, but while he was trying to scam me, I quietly worked on reversing the connection back to his computer. (This is the scammers phone system)

6/ This scam call center has Wi-Fi both inside and outside the building. By using the names of the wireless networks and their signal strengths relative to the scammers' computers, we can precisely determine the location of the scam call center. (28.5182833,77.2806568)

7/ Once I reverse the connection to one computer in a scam call center, it becomes very easy for me to pivot my access onto more machines. In this case I got access to multiple desktop computers and one laptop that gave me my first ever look into Sushil's scam operation.

8/ On this computer they were logged into Stripe and PayPal. They mainly used Stripe to take the payments from the victims. So I exported every single transaction that has ever been initiated on that stripe account.

9/ They run multiple ad campaigns, paying for google advertisements targeting specific keywords like "best internet provider" "internet deals" etc. So they not only impersonate Microsoft but they also claim to be from big companies like DirectTV, Xfinity, Spectrum and many more.

10/ After I gained access to all of the employees I managed to take control of Sushil's computer. On his computer I found a ton of juicy files like ID cards, Salary slips, Company registrations and even bank statements .

11/ Sushil typically uses the laptop to manage the finances, Website domains, the phone system and even his personal bank account.

12/ This is live footage of Sushil recruiting a new scammer to the team.

13/ These are photos that were downloaded directly from Sushil's cloud server. The photos from the server match perfectly with my webcam footage.

14/ Photos of Sushil and his car.

15/ At some point in my investigation the scammers realized I was spying on them and they fully panicked.

Let me know if you want to see more investigations like this one posted onto X. Leave a comment if you want me to upload the full length investigation on my second channel. Thanks for reading and have a good day.