Tech Support Scam Kit Uses Google Ads to Deliver Fake Security Alerts
Tech support scam kit uses Google Ads to deliver fake security alerts and lock browsers.
A tech support scam kit is leveraging Google Ads to distribute fake security alerts, making browsers appear locked and targeting users across hundreds of organizations. The campaign, observed by Netskope, uses a mouse movement trigger to evade automated analysis and displays convincing fake security alerts mimicking Microsoft Defender or Apple storefronts, pressuring users to call a support number.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Netskope?
Get an email when a new story names Netskope, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThis campaign exploits users' trust in familiar brands like Microsoft Defender and Apple by delivering convincing fake security alerts through paid Google Ads, making the threat appear highly legitimate. The use of a mouse movement trigger to evade automated analysis demonstrates that attackers are actively engineering their kits to bypass traditional security scanning tools. End users who lack training in recognizing social engineering tactics are the primary vulnerability being exploited here. This matters because successful scams can lead to financial loss, credential theft, and unauthorized remote access to corporate systems when victims call the fraudulent support numbers.
What helps against this
How we list vendors
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — CypherLoc