Security researchers have identified a widespread tech support scam campaign distributed through Google advertisements across numerous high-traffic websites including maps, weather, real estate, document hosting, and sports platforms. The malicious ads display fake security warnings that freeze computer screens on both Windows and macOS devices, urging users to contact a bogus call center for assistance.
From August 31 to September 14, security firm Netskope documented users from 619 customer organizations encountering the malicious ads, though the firm’s protective measures prevented actual infections. The organization identified more than 250 distinct Google Ads campaign IDs operating across at least 284 legitimate publisher websites. Approximately 62 percent of affected organizations were based in the United States, with Japan and Australia representing the second and third largest concentrations of exposure. Given that Netskope observes only a limited portion of overall internet activity, the true scope of exposure is believed to be substantially larger.
The scam employs sophisticated technical methods to appear convincing. Once activated following a mouse movement, the fake warning occupies the entire screen, disables standard exit commands, degrades browser performance, and plays audio alerts to create the impression of a serious infection. The malicious code is encrypted and only decrypted within browser memory, making detection by security software and ad filters more difficult. Additionally, the warnings display differently on Windows versus macOS systems.
Google stated it maintains a zero-tolerance policy toward scams and indicated it was actively investigating the campaigns while taking action against violating accounts. The company noted it blocked over 99 percent of policy-violating ads before distribution in the previous year but did not specify why these particular campaigns evaded detection or confirm complete removal from its platform.
Users encountering such fake warnings can escape without actually being compromised. Holding the escape key for several seconds typically forces the browser out of full screen mode. Windows users can alternatively use Control-Shift-Escape to open Task Manager and close the browser, while macOS users can employ Command-Option-Escape to access similar functionality. Legitimate companies never request users call phone numbers in response to detected infections.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI