A campaign analyzed by Netskope Threat Labs<\/a> uses Google Ads<\/a> To display fake security warnings on Windows and macOS. The browser appears to be blocked, but the goal is to trick the user into calling a fake tech support service.<\/b><\/p>\n A warning fills the entire screen. The cursor disappears, the browser slows down, and a screen mimicking Microsoft Defender or Apple warns of a security issue. A prominently displayed phone number appears to prompt immediate callers.<\/span><\/p>\n The computer, however, is not necessarily infected or blocked.<\/span><\/p>\n Netskope Threat Labs has documented the <\/span>September 24, 2026<\/b> a campaign of <\/span>tech support scam<\/span><\/i> Distributed via Google Ads. A tech support scam is a scam in which the user is convinced of a non-existent technical problem in order to trick them into paying, providing data, or granting access to their device.<\/span><\/p>\n According to Netskope, the user arrives on the page after clicking a Google ad. A loading screen is displayed first, followed by a normal-looking website. The malicious code waits for a mouse movement before activating, a technique used to avoid some automatic analysis systems.<\/span><\/p>\n At this point a different screen loads depending on the operating system.<\/span><\/p>\n On Windows it imitates <\/span>Microsoft Defender Security Center<\/b>. On macOS, however, it uses graphic elements attributable to Apple.<\/span><\/p>\n The page goes full-screen, hides the cursor, attempts to intercept the Esc key, and intentionally slows down the browser. It may also play alarm sounds and display messages warning you not to shut down your computer.<\/span><\/p>\n It all adds up to the same impression: the device is compromised and needs immediate assistance.<\/span><\/p>\n In fact, Netskope emphasizes that <\/span>the operating system continues to run<\/b>. It is the web page that creates the blocking effect.<\/span><\/p>\n Netskope observed the campaign between the <\/span>August 31 and September 14, 2026<\/b>.<\/span><\/p>\n In the period analyzed the following were detected:<\/span><\/p>\n Approximately 62% of the organizations observed were located in the United States, 16% in Japan, and 14% in Australia.<\/span><\/p>\n It's important to interpret these numbers correctly: they don't mean that 619 companies had their data stolen or made payments. They indicate the exposure Netskope observed to the campaign.<\/span><\/p>\n One of the most interesting aspects of the story concerns the point of entry.<\/span><\/p>\n The ads were also displayed on <\/span>legitimate publisher sites<\/b>. This means that the user did not necessarily have to be on an obviously suspicious page.<\/span><\/p>\n The site hosting the advertising space and the destination of the ad are two different elements.<\/span><\/p>\n That's why a generic rule like "don't visit strange sites" isn't enough. A scam can start even during a normal online search or while visiting a known site.<\/span><\/p>\n It therefore becomes more important to recognize what happens after the click.<\/span><\/p>\n Microsoft provides a very clear indication: <\/span>Genuine Microsoft error messages and warnings do not contain telephone numbers to call<\/b>.<\/span><\/p>\n If a window claims that your computer is infected and simultaneously provides the number of a technician to contact, this is a clear sign of a scam.<\/span><\/p>\n The risk increases if, during the call, you are asked to:<\/span><\/p>\n Microsoft warns that remote access can also be used to install malware, ransomware, or other unwanted programs.<\/span><\/p>\n The first rule is <\/span>do not call the number shown on the page<\/b> and do not install programs suggested by the warning.<\/span><\/p>\n For the campaign analyzed, Netskope indicates to hold down <\/span>Esc for a few seconds<\/b>. This can force you out of full-screen mode and allow you to close the tab.<\/span><\/p>\n If the browser still does not respond, it can be terminated through:<\/span><\/p>\n When reopening, it is best to avoid automatically restoring the previous session, as this could also reopen the fraudulent page.<\/span><\/p>\n On a company device, it is also advisable to report the incident to the IT manager through an already known contact.<\/span><\/p>\n In this case it is essential to reconstruct what really happened.<\/span><\/p>\n Simply viewing and closing the page is different from installing software, providing a password, or allowing remote access.<\/span><\/p>\n Microsoft recommends, depending on the incident, removing any apps installed at the scammers' direction, running a full scan, changing passwords, and considering resetting your device. If payments were made, it also suggests contacting your card issuer.<\/span><\/p>\n In a corporate setting, these operations should be managed together with those responsible for IT security, providing a complete reconstruction of the steps taken.<\/span><\/p>\n This campaign shows why cybersecurity can't be limited to saying "don't click on suspicious links.".<\/span><\/p>\n It is helpful for employees to already know:<\/span><\/p>\nHow the fake virus alert in the browser works<\/b><\/h2>\n
How widely was the Google Ads campaign distributed?<\/b><\/h2>\n
\n
An ad on a legitimate site can still be dangerous<\/b><\/h2>\n
If a helpline number appears, don't call it.<\/b><\/h2>\n
\n
What to do if your browser appears to be frozen<\/b><\/h2>\n
\n
What to do if you've already contacted fake support<\/b><\/h2>\n
What this means for your business<\/b><\/h2>\n
\n