This article lays out a new phishing trick that abuses Windows device enrollment through a fake update prompt, explains how the scam works in practical terms, highlights the risks once your device is enrolled, and offers clear steps you can take right now to spot and stop it.
Attackers have a new playbook that does not rely on traditional malware or stealing a password. Instead, they create a convincing fake update page that mimics a popular web service and tricks people into clicking a single button labeled Update now. That click launches a legitimate Windows setup flow that most users assume is safe, and that assumption is exactly what the attackers count on.
The scam uses a real Windows feature called device enrollment, which normally helps companies manage employee machines. What makes this dangerous is that the enrollment flow opens in an authentic system window named Set up a work or school account, so it does not look like a sketchy popup or a browser-only trick. Once that window is filled with attacker-controlled settings, clicking through effectively hands control of the device to whoever owns the management server.
Researchers traced the management endpoint used in the campaign to a legitimate device-management platform named Esper, which enterprises use every day. The platform itself is not malicious, but when attackers register their own management instance and trick individuals into enrolling, it becomes a remote-control channel. From that position they can push policies, install software, or lock and wipe the machine just like an IT admin could.
Even if only a small percentage of visitors complete the enrollment, the attackers still harvest valuable footholds. This kind of campaign is cheap to run and scales easily, so a fleeting burst of gullible clicks is enough to make it worthwhile for criminals. Security teams warn that because the operating system is being used legitimately, many antivirus tools and basic heuristics may not raise immediate alarms.
Here is the company response quoted exactly: “These ‘update now’ prompts are not legitimate Google communications. This is a phishing campaign that attempts to trick users into a Windows device enrollment process. Google Meet updates are handled automatically through your browser or the official app. Google will never prompt you to visit a third-party site to enroll a personal device to receive an update.”
If an unexpected system setup screen appears after you click a web link, stop and close it. Legitimate enrollment prompts normally appear during device configuration or after explicit instructions from your organization, not from a random webpage telling you to update. If you did not initiate enrollment or recognize the organization, do not proceed with any of the on-screen options.
On Windows, check Settings then Accounts and look for Access work or school to see whether your device is enrolled. If you find an unfamiliar account or organization listed there, disconnect it immediately and investigate. That section shows whether remote management has been granted and is the quickest way to verify whether someone else has admin-level access to your machine.
Basic habits make a big difference. Avoid clicking update prompts from random web pages and always open services directly through official apps or your known bookmarked URL. Use a password manager so credentials only autofill on the real login page, and treat any unexpected request for system-level setup as a red flag instead of a routine update.
Keeping Windows and your browser up to date is still important because updates patch vulnerabilities and harden system behavior. A good security stack with real-time protection can still spot unusual activity or software pushed after enrollment, though no single tool is a perfect solution. Be wary of any prompt that asks to enroll your device or to hand admin privileges to an unknown organization.
Attackers are shifting away from blunt-force malware to clever misuse of legitimate enterprise features, which makes social engineering and vigilance more important than ever. Protecting yourself is less about blocking a file and more about recognizing when a system dialog is being used as a weapon. If operating systems or management platforms need better safeguards to prevent abuse, that is a broader design conversation, but for now cautious behavior and quick checks on your account settings will block most of these tricks.
