Google Ads Deliver Sophisticated Tech Support Scam, Freezing Macs and PCs

Security researchers have identified a sophisticated tech support scam that leverages Google Ads to target users of both Windows and macOS operating systems. This malicious campaign, observed between August 31 and September 14, works by displaying deceptive advertisements across a wide array of legitimate websites. These sites include high-traffic platforms for services such as maps, weather forecasts, real estate listings, document hosting, and sports news, indicating a broad reach designed to ensnare a large user base. Upon interacting with these fraudulent ads, users' devices would experience a screen freeze, accompanied by urgent messages falsely claiming the system was infected. These pop-ups would then instruct the user to immediately contact a bogus technical support call center. The ultimate goal of the scam, according to security firm Netskope which monitored the activity, was to extort money from unsuspecting victims. Those who called the provided fraudulent numbers were pressured to pay substantial fees for unnecessary services, grant remote access to their computers—thereby exposing them to further compromise—or divulge sensitive personal information, such as login credentials or financial details.

Netskope's analysis revealed the scale of the observed campaign, noting that users from 619 customer organizations clicked on these malicious ads. However, Netskope's security infrastructure successfully blocked the fraudulent content, preventing any of these monitored users from becoming actual victims. This proactive blocking highlights the importance of advanced security solutions in mitigating such threats. Geographically, the scam showed a significant concentration in the United States, with approximately 62 percent of the affected organizations based there. Japan and Australia followed as the second and third most impacted countries, respectively, suggesting a global reach. It is crucial to note that Netskope's visibility into internet activity represents only a "tiny sliver" of the overall landscape. Therefore, the actual number of individuals exposed to these scam ads, including those who may have fallen prey to the deception, is presumed to be considerably higher. The firm's investigation further detailed that the scam utilized over 250 distinct Google Ads campaign IDs and appeared on at least 284 legitimate publisher websites, underscoring the extensive distribution network employed by the perpetrators. This widespread deployment on reputable platforms exploits user trust in both search engine advertising and the perceived legitimacy of online content, creating a potent vector for cybercrime.