All About Cookies is an independent, advertising-supported website. Some of the offers that appear on this site are from third-party advertisers from which All About Cookies receives compensation. This compensation may impact how and where products appear on this site (including, for example, the order in which they appear).
All About Cookies does not include all financial or credit offers that might be available to consumers nor do we include all companies or all available products. Information is accurate as of the publishing date and has not been provided or endorsed by the advertiser.
The All About Cookies editorial team strives to provide accurate, in-depth information and reviews to help you, our reader, make online privacy decisions with confidence. Here's what you can expect from us:
Netskope researchers have discovered a new scam that uses a fake virus warning to scare victims into calling a supposed tech support number.[1] All the victim has to do is click on an innocent-looking ad on a legitimate website, and suddenly their screen goes blank, alarms start blaring from their speakers, their mouse cursor vanishes, and Microsoft says that their computer is infected.
Panic-stricken, they press Escape, but nothing happens, and a phone number flashes on the screen: “Call immediately.” If they call that number, there’s a scammer waiting to extract personal information such as their name, address, phone number, and even credit card numbers. Giving away such sensitive information may lead to phishing scams, financial fraud, and even identity theft.
The scam reached at least 619 organizations over a two-week window, with 62% of affected organizations in the United States. Here’s everything you should know about this new attack and the steps you can take to stay safe.
As per Netskope’s report, the attack starts while you’re browsing a legitimate website, such as a sports site or a weather site, and you see a Google ad pop up. The scammers have paid for Google Ads so that their ads are shown to users just like any other ad would be.
Note that the websites have not been hacked; the scammers are simply using their normal ad inventory. When you click on the ad, you first see a loading screen with a spinning GIF indicating that the page is still loading. However, researchers discovered that you wouldn’t see anything else until you move your mouse.
This is a check placed by the scammers to evade automated bot detection. Security companies regularly use bots to scan websites and catch scams like this. However, bots don’t move a mouse, so the page quietly waits until it detects mouse movement. Once you do that, you’re taken to another page that looks like a regular online shop called “ShopEase.”
/images/2026/09/28/google-ad-scam-fake-virus-warning_01.jpg)
After you move your mouse, the page performs two decryption steps using hardcoded AES keys. It first decrypts a hidden string containing the address of the scammer’s server.
Next, it contacts that server and retrieves an encrypted payload tailored to the system you’re using, either Windows or Mac. The page then decrypts and assembles the fake warning inside the browser’s memory rather than downloading a separate locker file onto your computer.
If you’re using Windows, you’ll see a fake Microsoft Defender Security Center scanning page, claiming that your computer is infected with malware, along with several stacked system dialog boxes and a callback number. On macOS, the scam uses a fake Apple storefront.
/images/2026/09/28/google-ad-scam-fake-virus-warning_02.jpg)
Some other tactics it deploys:
However, the computer itself isn’t actually locked, and operating system controls still work. All of these are social engineering methods and scare tactics designed to get the user to call the support number flashed on the screen.
Scammers use this method to launch a tech-support scam, where they can try to extract money, personal information, financial details, or even remote access to the computer. Giving away such sensitive information could lead to financial fraud, unauthorized charges on your credit cards, and even identity theft.
This is a browser-level attack so simply opening the page doesn’t install malware on your operating system. The objective is to get you to call that number, allowing the scammers an opportunity to extract your personal information or money. This is why the attack is much easier to escape if you stay vigilant.
If you already called the number and shared personal information, such as your credit card details, call your financial institution immediately and block the card. Also, inform them of any unauthorized transactions you didn’t make. You could also choose to place a credit freeze with all three credit bureaus so that no one can open a new line of credit in your name.
Sharing such information can lead to identity theft, which is why it may also make sense to get an identity theft protection service. These tools can scan known breach databases and the dark web for your personally identifiable information and may help you restore your identity through professional restoration specialists.
Clicking on malicious links while browsing can sometimes lead to actual viruses or malware being downloaded onto your device. For protection against those threats, you’ll need a solid third-party antivirus program that scans downloads in real time and helps detect malicious files before they can harm your device.
The new Google Ads scam shows victims fake malware warning screens and stacked dialog boxes while displaying a callback number for an alleged tech-support team. However, waiting on the other side is a scammer attempting to extract personal information, money, or access to the computer.
While the attack page is designed to scare the victim, it operates at the browser level, so you can simply close your browser. Additionally, never call any number you see through an ad pop-up for tech support. Only reach out to the relevant company through its official channels.
An antivirus that scores 18/18 on AV-TEST for Windows and macOS, with top marks across all test categories
Passed every malware and drive-by download test we ran, quarantining threats automatically
Includes a junk cleaner, app uninstaller, and browser cleaner to keep your device running smoothly alongside the antivirus
/images/2022/09/08/malwarebytes-review.jpg)
/images/2023/08/30/norton-360-deluxe-vs-premium.png)
/images/2026/09/28/google-ad-scam-fake-virus-warning_1.png)
/images/2026/09/24/streamrat-free-streaming-android-malware.png)
/images/2026/09/22/hackers-track-finger-movements-steal-banking-passwords-rathat.jpeg)
/images/2026/09/15/closeup_of_subcribe_to_mrbeast_on_smartphone.jpg)
/images/2026/08/27/wordlistloader-malware-plain-english.jpeg)
/images/2026/08/26/children_hands_holding_apple_ipad_with_multiplayer_online_game_minecra_dQXyfjY.jpg)
/authors/krishi_chowdhary_headshot.jpg){kind=small}
/authors/kalleigh-lane-new.jpg){kind=small}
/images/2022/09/22/logo-totalav.png){kind=logo}
/authors/krishi_chowdhary_headshot.jpg)