Google Ads Spread Scareware to Millions via 250+ Campaigns
Original: Your uncle’s frozen Mac says it’s infected after viewing a Google ad. Now what?
Why This Matters
Scale of 250+ ad campaigns across 284 sites shows ad platforms remain a reliable scam delivery vector.
Security firm Netskope found Google ads delivering tech support scareware that freezes browsers on Windows and Mac. From Aug 31–Sep 14, users at 619 organizations clicked malicious ads across 284 legitimate sites.
Netskope researchers tracked a sophisticated tech support scam running through Google Ads between August 31 and September 14, 2026. The operation used more than 250 distinct Google Ads campaign IDs to push fake security warnings across at least 284 legitimate publisher sites — including high-traffic maps, weather, real estate, and sports destinations.
When clicked, the ads load a scareware kit that fills the entire screen with a fake infection warning, disables the address bar, suppresses Escape and other exit keys, degrades browser performance, and plays alarming sounds. Closing the browser simply refreshes the scam page. Critically, the payload only activates after a mouse movement is detected, and it runs encrypted in browser memory — two tricks that help it evade both endpoint security tools and Google's own ad filters.
Users who called the displayed phone number were pressured to pay fees, hand over remote device access, or share personal data. Netskope blocked the content for all 619 affected customer organizations, meaning no confirmed victims within its network. About 62% of those organizations were US-based; Japan and Australia ranked second and third.
Netskope acknowledged its visibility covers only a small fraction of total internet traffic, making the real exposure — and victim count — substantially higher. The scam's effectiveness hinges on appearing technically legitimate: no browser chrome, full-screen lockout, and staged system sluggishness convincingly simulate a real compromise.