A tech support scam distributed through Google Ads uses fake security warnings to make Windows and Mac browsers appear frozen, according to Netskope Threat Labs. Its September 24 report describes a campaign designed to push people into calling fraudulent support operators for payments, remote access or personal information.
What this means for Middle East security teams
The research does not establish a UAE or GCC incident count. Its relevance to regional enterprises is conditional: organisations whose employees encounter this type of advertising need a response that distinguishes a deceptive browser window from a compromised or locked operating system.
CWME’s assessment is that the immediate decision belongs with service desks as well as security teams. Because the scam tries to move users from a web page to a phone conversation, employees need a familiar internal route for help before they follow instructions displayed in the warning.
Key facts from the research
- Netskope recorded activity involving at least 619 organisations between August 31 and September 14, 2026.
- The researchers counted more than 250 Google Ads campaign identifiers across at least 284 legitimate publisher websites.
- The observed geographic distribution was approximately 62% United States, 16% Japan and 14% Australia; this is the vendor’s observed sample, not a global victim count.
- The kit presents different fake warnings for Windows and macOS. Netskope says the publisher sites themselves were not compromised.
How the tech support scam creates a false lock
The page initially resembles an online shop. Netskope found that mouse movement triggers the next stage, which retrieves and decrypts an operating-system-specific payload. This interaction requirement and encrypted delivery complicate automated inspection.
The resulting page uses full-screen display, a hidden cursor, restricted keyboard shortcuts, warning sounds and deliberate browser slowdown to make the device appear unusable. Netskope’s central distinction is that these effects occur in the browser: the operating system remains available.
The business risk is the next interaction
The operators seek payment, access to the device or sensitive information. Encountering the warning is therefore different from having paid the caller or granted access; the observed organisation count should not be described as a count of confirmed compromises.
For CISOs, that distinction helps frame triage. CWME’s assessment is that support teams should establish what the employee did after seeing the warning, rather than treating every frightening screen as evidence of the same outcome. The research does not identify a product vulnerability or a patch that resolves this social-engineering scheme.
How to leave the fake warning
Netskope advises users not to call the displayed number. Holding Escape for several seconds can release full-screen mode and the keyboard restriction, allowing the tab to close. If that fails, the report recommends closing the browser through Windows Task Manager (Ctrl+Shift+Esc) or macOS Force Quit (Cmd+Option+Esc), then reopening without restoring the previous session.
Security awareness guidance can use that concrete distinction: a web page demanding a support call is not proof that the operating system is locked. The practical objective is to stop the conversation with the scammer before payment, disclosure or remote access occurs.
Source and evidence
This article draws on John Carlo Marquez’s September 24, 2026 Netskope Threat Labs research, linked above. It replaces the earlier brief based on Ars Technica’s reporting with primary-source technical context and response guidance. CWME has not independently tested the kit; the findings describe Netskope’s visibility and do not establish regional prevalence.
CWME will continue tracking regional implications as more verified information becomes available.
Follow Cyber Warriors Middle East for further global cybersecurity developments.
