Netskope: Google Ads tech-support scareware (fake Defender/Apple locker) hit 619 orgs — AU ~14% (31 Aug–14 Sep)
Netskope Threat Labs (blog 24 September 2026; Ars Technica amplify 25 Sep) tracks a cloud-hosted tech-support-scam kit delivered via Google Ads. Victims click an ad on legitimate high-traffic maps/weather/real-estate/document/sports publisher sites, land on a spinner then a benign-looking “ShopEase” storefront; after a mouse-movement bot gate the kit AES-decrypts a hidden C2, fetches an OS-specific encrypted payload, and assembles a full-screen fake Microsoft Defender (Windows) or Apple (macOS) security locker entirely in browser memory (no inspectable file download). Locker uses requestFullscreen, hides the cursor, swallows exit keys, lags the browser, and pressures a call to a bogus support line for payment / remote access / personal data. Window observed 31 August–14 September 2026: ≥619 organisations in Netskope telemetry clicked the ads (Netskope blocked content so those customers were not scammed); geography of clicks ~62% US, ~16% Japan, ~14% Australia; >250 Google Ads campaign IDs across ≥284 publisher sites. Google statement (via Ars): zero tolerance for scams; actively investigating and will act on policy-violating accounts. No CVE. Distinct from desk ClickFix / browser-infostealer cards. Primary: Netskope; wire: Ars Technica 25 Sep.
- Product
- Browser tech-support scam kit via Google Ads (Windows Defender / Apple locker skins)
- Versions
- n/a (malvertising / social-engineering campaign; in-browser payload)
- Exploited in Australia?
- yes
- Patch to
- Block/alert on Google Ads → spinner → ShopEase-style storefront → fullscreen locker chains; user education not to call numbers on frozen browser warnings (close tab / Force Quit); review Google Ads policy enforcement; DNS/URL filtering for known locker C2 hosts per Netskope IoCs when published
Primary: Netskope Threat Labs — A Fake Security Locker, Delivered by Google Ads (24 Sep 2026) · Vendor: Netskope — fake security locker / Google Ads TSS kit · Ars Technica — Google Ads delivering convincing scareware (25 Sep 2026)