{
  "family": "gt32supportgeeks",
  "sample_count": 20,
  "category": "pua",
  "description": "GT32SupportGeeks (tracked in telemetry under signatures PUA:Win32/GT32SupportGeeks, Rogue:Win32/GT32SupportGeeks, and Program:Win32/GT32SupportGeeks) is a deceptive technical support scareware application and screen locker. Distributed via misleading pop-under advertisements, browser redirection loops, and bundled software installers, GT32SupportGeeks locks the user interface with an alarming full-screen error screen masquerading as a Windows fatal system crash (BSOD) or critical security lockdown. The interface displays toll-free telephone numbers coercing victims into calling fake technical support call centers, where fraudulent operators charge hundreds of dollars for fake remediation services and install secondary remote access tools. GT32SupportGeeks writes startup keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run, disables access to Task Manager, and suppresses keyboard shortcuts (such as Alt+Tab and Windows key) to prevent the user from exiting the scareware interface.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "PUA:Win32/GT32SupportGeeks",
    "Rogue:Win32/GT32SupportGeeks",
    "Program:Win32/GT32SupportGeeks",
    "Win32/GT32SupportGeeks",
    "Scareware.GT32SupportGeeks"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is PUA:Win32/GT32SupportGeeks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "GT32SupportGeeks is a tech support scareware program that locks the screen with fake fatal error warnings to coerce calls to fraudulent call centers."
      }
    },
    {
      "@type": "Question",
      "name": "How does GT32SupportGeeks prevent users from closing its lock screen?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It hooks keyboard combinations like Alt+Tab, blocks Task Manager execution, and renders a top-most borderless fullscreen window."
      }
    },
    {
      "@type": "Question",
      "name": "How does GT32SupportGeeks infect computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It enters through malicious browser redirects, drive-by pop-under ads, and bundled third-party freeware installers."
      }
    },
    {
      "@type": "Question",
      "name": "Should victims call the phone numbers displayed by the program?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No, the phone numbers connect to fraudulent call centers operated by cybercriminals attempting credit card extortion."
      }
    },
    {
      "@type": "Question",
      "name": "How can GT32SupportGeeks be safely removed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Reboot into Windows Safe Mode, terminate the rogue process, remove startup registry entries, and run a reputable antimalware scanner."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1189",
    "T1491.001",
    "T1547.001",
    "T1562.001",
    "T1112"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - PUA:Win32/GT32SupportGeeks",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/GT32SupportGeeks"
    },
    {
      "name": "Malwarebytes Labs - Tech Support Scams Overview",
      "url": "https://www.malwarebytes.com/blog/threat-intelligence"
    },
    {
      "name": "Sophos Threat Center - GT32SupportGeeks Analysis",
      "url": "https://www.sophos.com/en-us/threat-center/threat-analyses"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1491.001",
      "name": "Defacement: Internal Defacement",
      "tactic": "Impact"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Advise the end user not to call the displayed phone numbers or grant remote desktop access.",
    "Reboot the machine into Safe Mode with Networking to bypass the fullscreen lock hook.",
    "Terminate active scareware processes via Task Manager or elevated PowerShell commands.",
    "Remove startup registry entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Run a full antimalware scan to eliminate leftover scareware modules and reset browser preferences."
  ],
  "what_to_avoid": [
    "Do not call the displayed telephone numbers or provide payment card numbers.",
    "Do not install remote assistance utilities requested by unauthorized phone operators."
  ],
  "target_industries": [
    "Consumer Endpoints",
    "Small Business Workstations"
  ],
  "target_geographies": [
    "Global",
    "North America",
    "Europe"
  ],
  "threat_actors": [
    "Technical Support Scam Syndicates"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "defense_evasion"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Fraud & Tech Support Scam Extortion",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}