Google Ads Served Fake 'Your Computer Is Infected' Scam to Users on Weather, Maps and Real Estate Sites for Two Weeks

A tech support scam ran through Google's ad network for at least two weeks this month, hijacking browsers on trusted sites like weather pages, maps, real estate listings, and sports scores, according to security firm Netskope.

Netskope says it tracked the campaign from August 31 to September 14. In that window, users at 619 of its customer organizations clicked on the malicious ads. Netskope traced the campaign across more than 250 Google Ads campaign IDs and at least 284 legitimate publisher sites.

About 62 percent of the affected organizations were based in the US. Japan and Australia ranked second and third, Netskope said.

How the Scam Works

Click the wrong ad, and the browser appears to seize up. A fullscreen warning takes over, the cursor vanishes, and keys that would normally let someone escape, including Escape itself, stop working. The browser slows down, sounds play, and pages lag on purpose, according to Netskope's research.

A message tells the victim not to restart the machine and to call a phone number immediately. Anyone who dials in gets pressured to pay fees, hand over remote access to their device, or give up personal information, Netskope reported.

None of it is real. Nothing on the computer is actually locked or infected. It is a scare tactic built entirely out of browser code.

The kit behind it is built to dodge detection. Netskope found the warnings only trigger after a user moves the mouse, and the malicious code stays encrypted until it decrypts directly in browser memory. Both tricks help the scam slip past endpoint security software and, apparently, Google's own ad review process.

The Scale Nobody Can Fully See

Netskope says none of its own customers actually got scammed, because it blocked the malicious content before anyone called the fake number. But Netskope's visibility only covers a slice of internet traffic. The real number of people who saw these ads, and the number who actually picked up the phone and paid or handed over access, is almost certainly far larger than what one security vendor caught.

Google Ads runs through an automated bidding and placement system that puts ads on publisher sites without a human reviewing every single one before it goes live. That system is what let a scam campaign run across 284 sites and 250-plus campaign IDs for at least two weeks before Netskope's research became public. No source reviewed here indicates Google has issued a statement on this specific campaign or on how many of the flagged campaign IDs it has since removed.

Who Actually Falls For This, and Why That Matters

Ars Technica raised a point worth considering: plenty of people mock scam victims online, but a large share of internet users genuinely don't understand how their computer works. Combine that with people trying to get something done fast, plus a growing pile of technical friction just to use the web at all, and you get a population that is an easy mark, not a stupid one.

That cuts against the instinct to blame the "uncle" who fell for it. The scam is engineered specifically to exploit unfamiliarity, not carelessness. A cursor that vanishes and a browser that visibly lags is convincing to someone who has no baseline for what a real malware infection looks like versus what a fake one looks like.

None of that changes who profits from the con. The scammers built a kit specifically to survive ad review and antivirus detection. Google's platform delivered it to hundreds of legitimate publisher sites anyway.

What's Unresolved

No regulator has announced an investigation into this specific campaign, and Google has not published a public accounting of how many of the 250-plus flagged campaign IDs it removed or when. The open question is whether Google's ad-review pipeline gets tightened in response, or whether the same encrypted, mouse-movement-gated evasion tricks work just as well on the next batch of campaign IDs the scammers spin up.