Fake Vienna flat listing on willhaben leads to fzwh.at form that installs malware
Watchlist Internet, the Austrian consumer-protection information site, reported on 27 October 2026 a fake apartment listing on the classifieds platform willhaben. It offered a 60 m² flat in Vienna's 6th district for E…
- First reported
- Reports
- 1
Source: watchlist-internet.at · published
What happened
Watchlist Internet, the Austrian consumer-protection information site, reported on 27 October 2026 a fake apartment listing on the classifieds platform willhaben. It offered a 60 m² flat in Vienna's 6th district for EUR 700, which Watchlist calls suspiciously cheap. The person who enquired received a reply after an unusually short time, late at night, saying the flat was still available but that a form had to be completed to be considered for a viewing. The link was written as "fzwh. at", with a space, so that the platform's automatic link detection would not flag it, and the message said the form could only be filled in on a computer, not on a phone or tablet. willhaben's security team removed the listing quickly after the would-be victim reported it.
How the scam works
The form at fzwh.at asks about living and income circumstances. Submitting it requires a "reCAPTCHA" step, and a pop-up says a verification code is needed and tells the user to press Windows key + R, then Ctrl + V, then Enter. No code is involved. When the "submit" button is clicked, the page secretly puts a command on the clipboard. Win+R opens Windows' Run box, Ctrl+V pastes the command, and Enter runs it, installing malicious software. This technique is often called ClickFix. Watchlist says the form is limited to computers because the malware is not designed for phones or tablets.
According to people affected, the command connects to an external IP address that gives the criminals access to the device. They can then steal data, change passwords or reach any account the person is signed in to, such as online shops or banking. The form also collects personal details that may be used in later scams.
Watchlist's advice is to stay on the platform and refuse any request to move to WhatsApp, Telegram or another site. If you suspect malware, disconnect the device from the internet, run a full security scan, consider having an IT professional check it, and change important passwords such as email, online banking and ID Austria.
Source
Watchlist Internet, "Das Wohnungsinserat als Einfallstor für Schadsoftware" (27 October 2026).
Red flags
- A flat advertised far below the usual rent for its size and area.
- A reply within minutes, even in the middle of the night.
- A link to a form on another website, written with a space to avoid link detection.
- A claim that the form can only be filled in on a computer.
- A 'verification' step that tells you to press Windows+R, paste with Ctrl+V and press Enter.
If you were targeted
- 1Never paste and run anything because a website tells you to; no genuine verification asks you to open the Run box.
- 2Stay on the classifieds platform and don't move to external forms or messengers.
- 3If you followed the steps, disconnect the device from the internet, run a full security scan and consider IT help.
- 4Change important passwords (email, online banking, ID Austria) from a different, clean device.
- 5Report the listing to willhaben, and watch for follow-up scams using the details you entered.