Fake Security Alerts, Real Financial Risks

When a trusted search experience becomes an attack surface

Search engines are a starting point for discovering websites, products, and technical assistance. Sponsored results can appear credible when they resemble familiar brands. Attackers exploit this perception by promoting malicious destinations through advertising platforms. The underlying risk is not necessarily a compromise of the advertising platform itself: the platform becomes a channel for distributing deceptive content.

In the campaign investigated by Netskope and highlighted by KnowBe4, malicious webpages presented themselves as ordinary shopping destinations but could switch into a fake security experience. Rather than immediately stealing credentials, the pages attempted to persuade visitors that their computers had been compromised. This is social engineering built around a fabricated emergency.

How the attack unfolds

1. A seemingly legitimate sponsored result

A user follows an advertisement to a website that looks like a normal retail or promotional destination. Because the visit began with a search result, the visitor may be less cautious than they would be with a link in an unsolicited email.

2. An alarming but false security warning

The page begins imitating an operating-system security interface. On Windows, the observed campaign displayed Microsoft Defender-style warnings and fabricated scan results; on macOS, the attackers used Apple-themed messages. These alerts originated from the webpage, not the genuine operating-system security software.

3. Browser manipulation creates a sense of lost control

The attackers used techniques including fullscreen display, cursor hiding, attempts to interfere with shortcuts, and intentional browser slowdown. Alarm sounds and repeated visual warnings increased the pressure. The computer itself was not necessarily locked or infected: the page was attempting to make its own browser content feel like a system-level security incident.

4. The victim is pushed toward a support number

The fake alert instructed the user to call a displayed support number. Such calls can place victims directly in contact with fraudsters who may attempt to sell unnecessary services, obtain personal information, or persuade the victim to install remote-access tools. These are known patterns in tech support fraud; they are not confirmed outcomes for every exposure to this specific campaign.

Why this approach works

The campaign combines authority bias, fear, urgency, and perceived loss of control. A message resembling a trusted technology brand may be mistaken for an official instruction. Scary language about malware creates anxiety, while a fullscreen interface can make normal troubleshooting feel impossible. The requested action—call the number—then appears to offer an immediate solution.

What employees should do

• Do not call a phone number provided by an unexpected browser security warning.
• Treat a warning embedded in a webpage as unverified until independently confirmed by the organisation’s trusted security tools or IT team.
• Close the suspicious tab or browser; if normal controls are unavailable, use the operating system’s task-management functionality or seek help from IT.
• Do not share passwords, payment details, or remote-access permissions with unknown support operators.
• Report the suspicious website or incident through the organisation’s established reporting channel.

What organisations should improve

A layered response should combine web and DNS filtering, browser policy controls, endpoint protection, and clearly communicated support procedures. Employees should know exactly how to reach authorised IT support without relying on instructions contained in a suspicious alert. Organisations should also test employee readiness using scenario-based learning about impersonation and pressure tactics, not only conventional email phishing examples.

The PhishSheriff perspective: resilience beyond the inbox

Human Risk Management requires organisations to understand how employees respond to deceptive digital experiences. PhishSheriff combines AI-driven phishing simulations, security awareness, behavioural intelligence, and a unified Human Risk Score to support ongoing assessment and improvement. Relevant simulated communications and training scenarios can reinforce independent verification, safe escalation, and resistance to urgency-based manipulation. These measures complement rather than replace browser, network, and endpoint protections.

Conclusion

The Google Ads tech support campaign shows that a convincing warning is not always a real warning. Attackers can manufacture the appearance of technical authority inside a browser and use it to influence human decisions. Continuous awareness and clear verification habits reduce the chance that a fabricated emergency becomes a genuine security incident.