Google Ads Spreading Sophisticated Tech Support Scams
Malicious ads freeze devices and trick users into fake support calls.
1Scam mechanics revealed
Security researchers discovered Google Ads delivering sophisticated tech support scams that freeze both Windows and Mac screens. The ads display urgent messages directing users to call fake support centers. This tactic bypasses traditional security measures by leveraging legitimate ad networks. The scam targets users across high-traffic websites including maps, weather, and document-hosting platforms.
2Global reach of attacks
From August 31 to September 14, Netskope detected users from 619 organizations clicking these malicious ads. About 62% of affected organizations were based in the US, with Japan and Australia ranking second and third. The security firm blocked all scam attempts within their monitored network, preventing actual compromises. However, the true scale is likely much larger given Netskope's limited visibility into global internet traffic.
3Scammer tactics
When users called the displayed numbers, they were pressured to pay large fees, grant remote access, or disclose personal information. The scammers employed professional-sounding scripts to appear legitimate. This represents an evolution of traditional tech support scams, now distributed through mainstream advertising channels. The operation suggests organized cybercrime groups behind the campaign.
4Publisher vulnerability
Netskope identified the malicious ads running on at least 284 legitimate publisher sites. More than 250 distinct Google Ads campaign IDs were tracked. The widespread distribution across reputable platforms increased the scam's credibility. This highlights vulnerabilities in digital ad ecosystems where malicious content can bypass screening processes.
5Technical execution
The attacks didn't require malware installation, instead using browser-based techniques to freeze screens. This fileless approach makes detection more challenging for traditional antivirus solutions. The scammers likely used JavaScript injection or similar methods to create the lock-screen effect. The sophistication suggests ongoing refinement of these social engineering tactics.
6Enterprise implications
While no Netskope-monitored organizations were successfully compromised, the incident demonstrates workplace risks. Employees accessing personal sites during work hours could inadvertently expose corporate networks. The case underscores the need for layered security beyond just endpoint protection, including web filtering and user education about emerging threats.
7Ad platform responsibility
The incident raises questions about Google's ad verification processes. Despite policies against malicious content, sophisticated scams continue slipping through. The scale suggests either inadequate screening or scammers finding new ways to evade detection. This isn't isolated to Google - similar issues affect most digital ad platforms.
8Protective measures
Users should be wary of unsolicited tech support messages, especially those creating urgency. Organizations need to implement DNS filtering and educate staff about these evolving threats. The case highlights how cybercriminals are weaponizing legitimate advertising infrastructure. Future defenses must address the ad ecosystem's vulnerabilities to prevent similar large-scale scams.
Original article: Biz & IT - Ars Technica — Google Ads Spreading Sophisticated Tech Support Scams