From Ars Technica · · 2m
Fake virus warnings spread through Google ads
Scammers used Google's ad network to deliver convincing tech support scams that froze screens and pressured users to call fake support lines.
In brief
Scammers used Google's ad network to deliver convincing tech support scams that froze screens and pressured users to call fake support lines. Press and hold escape or use Task Manager to force-close the browser window; no legitimate company will ever ask you to call a number when infected. Originally reported by Ars…
Google ads delivered fake virus warnings
Researchers found scam ads across weather, maps, sports and real estate sites that froze screens and displayed urgent messages telling users to call a bogus support center.
The scam reached hundreds of thousands
From August 31 to September 14, security firm Netskope tracked over 250 Google ad campaigns across at least 284 legitimate sites. Users from 619 organizations clicked the malicious ads, with 62 percent based in the US.
The fake warnings were extremely convincing
The scam hid the browser address bar, disabled escape and other exit keys, degraded performance, and played sounds to make users believe their device was infected and locked.
“The locker fills the screen, hides the cursor, swallows the usual exit keys, and lags the browser, all to manufacture the sense of a broken machine.”
Why people fall for these scams
Many internet users lack basic computer knowledge and feel pressured to fix problems quickly. Combined with the scam's sophisticated design, this makes them vulnerable targets.
The scam evaded Google's detection
The malicious software was encrypted, only decrypted in browser memory, and triggered only after mouse movement. These tricks helped it bypass Google's ad filters and security software.
Google says it's investigating
Google stated it has zero tolerance for scams and is actively investigating the campaigns, though it didn't explain how the ads slipped through or confirm they've been fully removed.
“We have zero tolerance for scams. We're actively investigating the campaigns in this report and will take action against accounts that violate our policies.”
How to escape the fake warning
Press and hold escape for several seconds to force the browser out of full screen, then close the tab. On Windows, use Control-Shift-Escape to open Task Manager and close the browser.
Never call the number on the screen
No legitimate company will ask you to call a number when your device is infected. If you see this warning, close the browser and ignore the message completely.
“No legitimate company will ever advise users to call a phone number when they're infected.”
The headline
Press and hold escape or use Task Manager to force-close the browser window; no legitimate company will ever ask you to call a number when infected.
