Security firm Netskope identified a malicious campaign within Google Ads that displayed fake security warnings to users across at least 284 legitimate websites. Between August 31 and September 14, the firm tracked over 250 unique campaign IDs. These ads targeted users on various platforms, including sites for maps, weather, and document hosting.
The malicious software mimics system infections by disabling browser controls, hiding cursors, and triggering performance lags. It only activates after a mouse movement and uses encryption to bypass security filters. The warnings are tailored to the user's operating system, specifically targeting both Windows and macOS environments.
Netskope observed users from 619 customer organizations clicking these ads, with 62 percent of affected entities based in the US. While Netskope blocked the content for its clients, the total number of victims remains unknown. Japan and Australia were the second and third most affected regions.
Google stated it is investigating the reports and will take action against violating accounts. The company noted that it blocked over 99 percent of violating ads last year. However, Google did not confirm if the specific campaign has been fully removed from its platform or explain why its scanners failed to detect the malicious ads.
Experts emphasize that these devices are not actually locked. Users can exit the fake warnings by holding the escape key for several seconds or using system tools like the Task Manager on Windows or the Force Quit menu on macOS. Security professionals advise against calling any phone numbers displayed in such pop-ups.
