Researchers at Netskope are tracking a phishing kit that hijacks users’ browser windows to display fake security alerts. The malicious websites are distributed via Google Ads, and pose as normal online stores. Once a user clicks a link on the page, however, the site will present them with an urgent-looking security warning.
“The decrypted payload is tailored to the victim’s operating system,” the researchers write. “On Windows, it impersonates Windows Defender, with a fake ‘Microsoft Defender Security Center’ scan claiming the machine is infected with malware, stacked system dialogs, and a callback number. The macOS branch is the same scam reskinned over a fake Apple storefront. These are typical social engineering tactics used in tech scams, meant to induce panic and a sense of urgency to call the number they flash repeatedly.”
Notably, the page also traps the victim on the screen, further increasing the sense of urgency and making the victim feel like the only solution is to call the phone number.
“The first click anywhere forces the page into full screen with requestFullscreen(), hiding the address bar and tabs so the fake warning fills the whole display,” Netskope says. “It then hides the mouse cursor and calls the browser’s keyboard-lock API to swallow the Escape key and other exit shortcuts, so the usual ways out stop responding. On top of that, it deliberately degrades the browser, playing alert sounds on interaction and running busy loops that make the page stutter and lag, reinforcing the illusion that the machine is broken. While the victim stays in full screen, a black lockout screen (‘Do not restart or operate the computer… call immediately’) flashes over everything, and trying to close the tab triggers the browser’s own confirmation dialog carrying the scam’s message. None of this actually locks the computer, and operating-system controls still work, but together they make a convincing page that pressures the victim into calling the number.”
Netskope has the story: https://www.netskope.com/blog/a-fake-security-locker-delivered-by-google-ads
