Quick Answer
Google Ads are delivering fake security alerts that make a browser appear frozen, but the pages do not actually lock the computer. Netskope identified a cloud-hosted campaign reaching at least 619 organizations, mostly in the United States. Do not call the displayed number or install software. Exit full-screen mode, force-close the browser, and report the ad.
Key Takeaways
- The Google Ads tech support scam uses fake Windows and Mac security warnings.
- The malicious page waits for mouse movement before loading its full fake alert.
- The browser may become slow and difficult to exit, but the scam does not lock the computer.
- Holding Escape or force-closing the browser can end the immediate screen takeover.
- Google said it was investigating the campaigns and would act on policy violations.
What is the Google Ads tech support scam?
The Google Ads tech support scam is a browser-based fake security alert that directs victims to call a fraudulent support number. The campaign uses paid Google Ads to send people to legitimate publisher websites, where malicious advertising code loads a convincing warning after the page opens. The fake warning is designed to create urgency, not to prove that malware has infected the device.
Netskope Threat Labs published details of the campaign on September 24, 2026, describing a cloud-hosted scam kit that had reached at least 619 organizations between August 31 and September 14. Roughly 62% of affected organizations were in the United States, compared with 16% in Japan and 14% in Australia. Netskope’s threat research found that the affected publisher sites were legitimate and had not themselves been compromised.
The distinction matters because a familiar website does not guarantee that every advertisement displayed on it is safe. The practical response is to treat a sudden full-screen security alert with a phone number as a likely scam, particularly when the page insists that immediate phone support is required. Paid-placement abuse remains one reason users should be careful with malware advertisements on social platforms and search results alike.
How does the fake security alert reach a browser?
The Google Ads tech support scam reaches browsers through more than 250 Google Ads campaign IDs and at least 284 legitimate publisher sites. Netskope identified affected sites in several categories, including maps, weather, real estate, document hosting, and sports. The broad placement strategy gives the campaign many opportunities to reach users who were not actively searching for technical support.
The malicious code waits for a mouse movement before it decrypts a hidden command-and-control address, requests an operating-system-specific encrypted payload, and assembles the fake warning in browser memory. That sequence makes a simple page inspection less useful because the fraudulent content does not fully appear until the visitor interacts with the page.
Windows visitors receive a fake “Microsoft Defender Security Center” infection alert, while Mac visitors receive a fake warning styled around an Apple Store theme. Both versions display a callback number for supposed support. The operating-system-specific design makes the page appear more credible, but the phone number is the central objective because the scam depends on getting the victim into a live conversation.
Why does the Google Ads scam make the browser seem frozen?
The Google Ads browser scam makes the browser seem frozen by using full-screen mode, hiding the cursor, intercepting some keyboard shortcuts through the browser keyboard-lock API, and deliberately slowing browser activity. Netskope says the page does not actually lock the computer, even when the warning makes the device appear unusable.
The simulated lock screen works because it removes normal visual cues and makes routine actions feel unreliable. A user who cannot immediately see a browser tab, mouse pointer, or close button may assume the warning has control of the operating system. The fake alert instead relies on the browser window and the victim’s uncertainty about how to exit it.
| What the screen does | What it is meant to suggest | What it actually means |
|---|---|---|
| Enters full-screen mode | The computer has been locked | The browser is covering the normal desktop controls |
| Hides the cursor | Mouse control has been disabled | The scam page is changing the browser presentation |
| Slows browser activity | Malware has damaged the computer | The page is trying to make exiting feel difficult |
| Shows a support number | Microsoft or Apple needs to help immediately | The caller is being directed to bogus support |
The most important point is that the apparent freeze is part of the social engineering. Avoid clicking repeatedly or following on-screen instructions. Focus on leaving the browser instead of trying to diagnose the claimed infection from the alert itself.
How do you exit a fake browser security alert safely?
Exit the fake browser security alert without calling the displayed number or installing any software. Netskope advises holding the Escape key for several seconds to leave full-screen mode, although a scam page can try to interfere with ordinary keyboard input. Force-close the browser if Escape does not restore normal controls.
- Hold the Escape key for several seconds to try to exit full-screen mode.
- Press Ctrl+Shift+Esc on Windows to open Task Manager, then end the browser task.
- Press Cmd+Option+Esc on a Mac to open Force Quit Applications, then force-quit the browser.
- Reopen the browser without restoring the previous session if the fraudulent tab reappears.
- Report the ad or site through the browser or advertising platform after the browser is closed.
The browser should be force-closed if the fake warning remains visible or normal controls do not return. Force-closing ends the active page session, which removes the immediate visual pressure without requiring the victim to engage with the displayed phone number. Users who see suspicious prompts on a phone can also benefit from phone-level scam warnings where those protections are available.
Stop and contact a trusted computer-support provider if software was installed, credentials were entered, or instructions from the caller were followed. The published campaign details establish that the page itself does not lock the computer, but a support scam can become more serious after a victim provides access or follows additional instructions.
What should you do after closing the fake alert?
The Google Ads tech support scam requires caution after the browser is closed, but a fake alert alone does not establish that the device has been infected. The campaign described by Netskope is built to display a fraudulent warning and push a callback number. Closing the page and avoiding the number prevents the direct interaction the scam is seeking.
Review the browser’s recently opened tabs and remove any unfamiliar permissions that were granted during the incident. Check downloads for files you did not intentionally request, then remove suspicious files without opening them. The practical goal is to identify actions that occurred after the alert appeared, rather than assuming the alert itself proves that the operating system was compromised.
Change passwords from a separate trusted device if you entered account credentials into a page connected with the incident. Contact the relevant bank or service provider through its official website or app if you provided payment information. Account takeovers can begin with convincing prompts, as shown by other cases involving fraudulent software and replaced wallet extensions, so prompt action is more useful than continued interaction with the original page.
How can you recognize a fake tech support warning?
A fake tech support warning usually combines an alarming security claim, a prominent phone number, and instructions to act immediately. The Google Ads campaign imitates recognizable security brands and changes its presentation for Windows and Mac visitors, which makes the warning look tailored to the device. Genuine operating-system alerts do not need users to call an unverified number shown in a browser window.
Browser-based warnings also deserve additional scrutiny when they appear in full-screen mode and make basic navigation difficult. A legitimate security product may notify users about a detected issue, but a legitimate warning does not need to hide the cursor, slow the browser, or prevent the user from easily reaching normal controls. The combination of those behaviors is the warning sign.
- Unexpected full-screen mode that hides normal browser controls.
- A claimed infection paired with a phone number for immediate support.
- Branding that imitates Microsoft, Apple, or a security product.
- Instructions to call, download software, or follow urgent on-screen steps.
The most sensible approach is to independently open the official website for the company named in the warning rather than trusting the page already on screen. Search-result ads and web-page ads require the same skepticism because an ad placement is not proof that the destination is legitimate.
What has Google said about the scam campaigns?
Google said it was investigating the Google Ads scam campaigns and would act against accounts that violated its policies. The company told Ars Technica on September 25, 2026, that it has “zero tolerance for scams.” Google’s statement to Ars Technica does not identify a final enforcement outcome for every campaign ID cited in Netskope’s research.
Google’s broader enforcement figures show the scale of the advertising platform’s screening task. Google said it blocked or removed 8.3 billion ads, suspended more than 24.9 million advertiser accounts, and stopped more than 99% of policy-violating ads before they were served in 2025. Google’s 2025 Ads Safety Report presents those figures as the company’s own enforcement results.
Those enforcement statistics do not mean every harmful advertisement is blocked before a user sees it. The Netskope campaign demonstrates the remaining risk: fraudulent ads can reach legitimate publisher sites and use browser features to create a convincing false emergency. Users should report suspicious ads, but should still leave the page immediately rather than waiting for platform action.
How can you reduce the risk from malicious ads?
Malicious-ad risk is reduced by treating unexpected security pop-ups as untrusted until they can be verified outside the affected browser tab. The Google Ads campaign depends on the visitor accepting the message’s urgency and calling the number before considering whether the alert is genuine. Pausing long enough to close the browser changes that calculation.
Keep browsers and operating systems updated, and use the browser’s built-in tools to report advertisements that display fraudulent support numbers. Avoid entering credentials, payment information, or recovery codes after a warning appears. A scam page can be visually persuasive without having any authority over the computer or the accounts it claims to protect.
Independent verification remains the safest next step. Open a new browser session, use a bookmarked official support page, or contact a provider through a number printed on a billing statement or listed in its official app. The Google Ads tech support scam is designed to make the fraudulent route appear faster, so choosing a verified route is the key protection.
FAQ
Can a fake browser alert really lock my computer?
The fake browser alert described by Netskope does not actually lock the computer. The scam uses full-screen mode, cursor hiding, keyboard controls, and browser slowdowns to make the device appear locked.
Should I call the number in a Microsoft or Apple security pop-up?
You should not call the number shown in an unexpected browser security pop-up. The Google Ads campaign uses Windows- and Mac-themed warnings to direct victims to bogus support.
What keys close a fake full-screen warning on Windows?
Windows users can hold Escape for several seconds to try to leave full-screen mode, then press Ctrl+Shift+Esc to open Task Manager if needed. Force-close the browser if the fraudulent page remains active.
What keys close a fake full-screen warning on a Mac?
Mac users can hold Escape for several seconds to try to exit full-screen mode, then press Cmd+Option+Esc to open Force Quit Applications. Force-quit the browser if normal controls do not return.
Were the websites hosting the Google Ads scam hacked?
The legitimate publisher sites identified in Netskope’s research were not compromised. The malicious behavior came through advertising campaigns that delivered the fake browser warning on those sites.