Google ads delivering tech support scam, Netskope finds

Google ads tech support scam has returned with a vengeance, and this time it comes dressed as an ordinary click on a familiar website. Researchers have uncovered a sprawling campaign in which paid search placements served up sophisticated scareware that freezes screens on both Windows and Mac machines and flashes an urgent message telling victims to phone a bogus call center. The ads turned up across the open web, landing on maps, weather, real-estate, document-hosting, and sports properties that millions of people visit without a second thought.

The Ads Looked Ordinary Until They Weren't

This wave of Google ads tech support scams works. Why? Because it asks so little. There's no malicious download to approve and no suspicious attachment to open, which means a target doesn't have to do anything unusual or even slightly suspicious to end up caught in something they can't easily escape. A single click on a sponsored link triggers the trap. And the trap is built to feel like a catastrophe in progress.

Between August 31 and September 14, security firm Netskope watched users from 619 customer organizations click on the malicious ads. Nobody got defrauded. Netskope blocked the content first. Roughly 62 percent of the affected organizations were based in the United States, with Japan and Australia taking the second and third spots. And that figure represents only a sliver of overall internet traffic, so the true number of people exposed to these ads, including those who fell for them, is almost definitely far larger.

The scale of the operation shows in its infrastructure. Netskope tracked more than 250 Google Ads campaign IDs running across at least 284 legitimate publisher sites. This was not a handful of rogue placements. It was an organized buy.

How the Screen Freeze Actually Works

The trickery begins the moment the page loads. Nothing on the machine is genuinely locked, but the software kit is engineered to make that distinction impossible to see in the moment.

For the victim, that tradecraft turns an ordinary ad click into a browser that appears to seize up on a fake security warning. The locker fills the screen, hides the cursor, swallows the usual exit keys, and lags the browser, all to manufacture the sense of a broken machine and pressure the person into calling the number on the screen.

Every visible cue of a real infection gets mimicked. The address bar disappears. The warning occupies the entire display. Escape and many other keys stop responding. Browser performance degrades, sounds play, and pages lag. Messages urge the user not to restart the machine and to call a call center right away. Attempts to close the browser only refresh the scam message.

Two design choices keep the payload out of sight. The warnings appear only after the user makes a mouse movement, and the software stays encrypted until it is decrypted directly in browser memory, which means it's hidden until that exact moment. Both conditions help it slip past many endpoint security tools. And possibly past Google's own ad filters. The warning screens also render differently depending on whether the target is running Windows or macOS, so they're tailored to whatever system they land on.

Google's Response Leaves Questions Open

Google hasn't explained what caused its scanners to miss the campaign. It hasn't said whether the ads are fully purged either. The company issued a statement insisting it has zero tolerance for scams and is actively investigating the campaigns, promising action against accounts that violate its policies. And it says it blocked over 99 percent of violating ads last year before they were ever served.

A 99 percent block rate still leaves an enormous absolute number of bad ads in circulation given the sheer volume Google handles, and this campaign ran for at least two weeks across hundreds of publisher sites before researchers documented it.

Who Actually Falls for These Scams

Mocking the victims is a popular pastime online. It's unkind. It's strategically useless too. A sizable portion of internet users have little or no understanding of how computers and networks actually work, and when you combine that gap with the pressure to get things done quickly and the growing difficulty of navigating a web stuffed with consent banners and dark patterns, you get a large population of prime targets. And they're easy to hit.

Odds are good that most critics have a close friend or family member in exactly that group.

The uncle with the frozen Mac is not a punchline. He is a demographic.

What to Do When the Screen Locks Up

The single most important rule is simple. No legitimate company will ever tell a user to call a phone number because their machine is infected. So don't dial. Anyone hit by a Google ads tech support scam should never dial the number on the screen, because doing so leads to pressure for hefty fees, requests for remote access to the device, or demands for personal information.

Escaping the fake warning is easier than it looks. Here's the thing. Devices aren't actually locked, even though the usual exit keys have been disabled, and that's why so many people panic when they see the screen and assume they've lost control of the machine entirely. The fixes are straightforward:

• On both Windows and macOS, press and hold the escape key for several seconds. This forces the browser out of full screen and releases the keyboard lock, after which the tab can be closed.
• On Windows, invoke Task Manager with control-shift-escape and exit the browser from there.
• On a Mac, use cmd-option-escape to bring up the force quit window.
• Reopen the browser afterward without restoring the previous session.

They're the ones friends and relatives call. Those who serve as informal tech support for friends and relatives might take one extra step, and it's a small one, but it's the kind of thing that saves everyone a frantic phone call later. Write the escape-key trick on a sticky note. Attach it to the monitor. So the advice is there before panic sets in, sitting right where they're already staring, waiting for the moment when they can't figure out what happened and don't know who to ask.

The Bottom Line

Paid search remains one of the most trusted surfaces on the internet, and that trust is precisely what makes it valuable to criminals. A sponsored result carries an implicit endorsement that an organic link never gets. Until ad platforms can reliably separate legitimate buyers from operations running 250-plus campaign IDs across nearly 300 websites, the safest posture for everyday users is a healthy skepticism toward any ad that demands urgent action. The screen is not broken. The phone number is.

Frequently Asked Questions

What is the Google ads tech support scam described in the article?

It is a sprawling campaign in which paid search placements served up sophisticated scareware that freezes screens on both Windows and Mac machines and flashes an urgent message telling victims to phone a bogus call center. The ads turned up across the open web, landing on maps, weather, real-estate, document-hosting, and sports properties. A single click on a sponsored link triggers the trap, and the trap is built to feel like a catastrophe in progress.

Why does this wave of Google ads tech support scams work so effectively?

It works because it asks so little: there's no malicious download to approve and no suspicious attachment to open, so a target doesn't have to do anything unusual or even slightly suspicious to end up caught. The software kit is engineered to make the distinction between a real and fake lock impossible to see in the moment, manufacturing the sense of a broken machine. The locker fills the screen, hides the cursor, swallows the usual exit keys, and lags the browser to pressure the person into calling the number on the screen.

How does the screen freeze trickery actually operate on a victim's machine?

Nothing on the machine is genuinely locked, but every visible cue of a real infection gets mimicked: the address bar disappears, the warning occupies the entire display, escape and many other keys stop responding, and browser performance degrades. Two design choices keep the payload out of sight—the warnings appear only after the user makes a mouse movement, and the software stays encrypted until it is decrypted directly in browser memory. The warning screens also render differently depending on whether the target is running Windows or macOS, so they're tailored to whatever system they land on.

When did Netskope observe users clicking on the malicious ads, and who was affected?

Between August 31 and September 14, security firm Netskope watched users from 619 customer organizations click on the malicious ads. Nobody got defrauded because Netskope blocked the content first. Roughly 62 percent of the affected organizations were based in the United States, with Japan and Australia taking the second and third spots, though that figure represents only a sliver of overall internet traffic.

What should someone do if their screen locks up from a Google ads tech support scam?

The single most important rule is simple: no legitimate company will ever tell a user to call a phone number because their machine is infected, so don't dial. On both Windows and macOS, press and hold the escape key for several seconds to force the browser out of full screen and release the keyboard lock, after which the tab can be closed. On Windows, invoke Task Manager with control-shift-escape and exit the browser from there; on a Mac, use cmd-option-escape to bring up the force quit window, then reopen the browser afterward without restoring the previous session.