Google Ads Campaign Spreads Fake Security Alerts That Lock Browsers and Push Malware
Netskope found Google Ads scareware that fake-locks browsers and pushes victims to call fraudulent support lines.
Netskope Threat Labs reported a browser-based scareware kit delivered through paid Google Ads from August 31 to September 14, 2026. Researchers saw more than 250 campaign IDs on at least 284 legitimate publisher sites, 457 scam hosts, and exposure at 619 organizations, without confirmed infections or losses. Pages wait for mouse movement, decrypt a hidden address, and render fake Microsoft Defender or Apple alerts in memory that force full-screen mode and display a support number. Merely opening the page does not install malware; callers may be pushed to pay, share financial details, or grant remote access. Ad-click geography was about 62% United States, 16% Japan, and 14% Australia.
- Paid Google Ads on legitimate publisher sites delivered the scareware.
- Campaign reached 619 organizations through more than 250 ad IDs.
- Mouse-movement checks and in-memory alerts evade automated scanners.
- Fake Microsoft Defender and Apple warnings demand a support call.
- Opening the page does not install malware; the aim is fraud or remote access.
- ATT&CK
- T1583.008 MalvertisingT1036 MasqueradingT1497.002 User Activity Based ChecksT1140 Deobfuscate/Decode Files or Information
- Products
- Google AdsMicrosoft Defender
- Organizations
- Netskope
- Countries
- United StatesJapanAustralia
From the original article
3 min read at cybersecuritynews.comMalicious ads are steering people to fake security warnings that appear to take over their browsers. The pages urge visitors to call a supposed support line, turning a routine ad click into an attempt to extract money, personal details or access to a computer. The trap begins on a cloud-hosted page with a loading spinner […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.