Google Ads Deliver Tech Support Scam Kit with Fake Security Alerts

• •The scam targets users via Google Ads on legitimate websites.
• •619 organizations were exposed, primarily in the U.S., Japan, and Australia.
• •The kit uses mouse movement detection to evade automated scanners.

A tech support scam kit has been identified that uses Google Ads to deliver fake security alerts, locking browsers and targeting users across at least 619 organizations. The campaign was observed between August 31 and September 14, 2026, with 62% of affected organizations located in the United States. Victims are lured by ads on legitimate sites, leading to a loading spinner that transitions to a fake online store branded 'ShopEase.' The kit employs mouse movement detection to evade automated analysis, activating only after user interaction. Once triggered, it decrypts a command-and-control address and retrieves a tailored fake security alert for either Windows or macOS systems. The fake alerts mimic legitimate security software, pressuring users to call a bogus support number. Netskope Threat Labs reported that the scam creates the illusion of a locked browser, making it difficult for users to exit or regain control.