GoKawiilGoogle Ads Spread Tech Support Scam Locking Windows and Mac Browsers
Security firm Netskope found Google ads pushing a browser-locking scam across hundreds of legitimate websites, including maps, weather and sports sites, from August 31 to September 14. The fake alerts freeze the screen, hide the cursor and disable exit keys to pressure victims into calling a bogus support number, where scammers demand fees, remote access or personal data; Netskope says it blocked the attempts for the 619 client organizations it monitored, over 60 percent of them in the US.
GoKawiil's interpretation of the reporting above, not reported fact.
Because Netskope can only see a fraction of internet traffic, the actual number of people exposed to or victimized by this campaign is likely far larger than what was recorded. The reliance on Google's ad platform to distribute the scam across hundreds of trusted publisher sites suggests weaknesses in ad-network vetting that could be exploited again unless addressed. The scam's design specifically targets less tech-savvy users, indicating attackers are refining psychological pressure tactics rather than just technical exploits.
- Netskope tracked over 250 malicious Google Ads campaign IDs across at least 284 legitimate publisher sites.
- The scam mimics a frozen device via a full-screen lock, hidden cursor and disabled exit keys, though nothing is actually locked.
- US-based organizations accounted for about 62% of exposure, with Japan and Australia next, though true reach is likely underestimated.
Malwarebytes Premium Security Software — With scareware and tech support scams spreading through malicious ads on legitimate sites, having real-time protection that blocks malicious pages and pop-ups before they lock your screen is invaluable. Malwarebytes runs on both Windows and Mac, making it a solid pick to protect relatives like Uncle Louie who click on the wrong ad. It also includes tools to detect and remove scareware if a device does get compromised.
See Malwarebytes Premium Security Software on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: arstechnica.com, 2026-09-25
Published there as: “Your uncle’s frozen Mac says it’s infected after viewing a Google ad. Now what?”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.