Netskope Threat Labs has been tracking a cloud-hosted tech-support-scam (TSS) kit that hijacks a victim’s browser with a fake security alert and pressures them into calling a bogus support line, where the goal is to either extract payment for fake “support,” gain remote access, or collect personal and financial details. Victims arrive by clicking a Google ad and land on a loading spinner webpage then into what looks like an ordinary online store, with nothing that reads as malicious.
What makes the kit stand out is the tradecraft it uses to evade analysis. Before anything runs, it waits for a single mouse movement. This serves as a bot filter, because the automated scanners and crawlers that inspect the page would not cause such a cursor movement. Only once that movement is detected does the kit decrypt a hidden C2 address, pull down an encrypted payload (tailored to whether the victim is on Windows or a Mac), and assemble the fake alert within browser memory, so no inspectable file crosses the network.
What we saw first
The kit first came to our research team’s attention through a cluster of Netskope detections pointing at cloud-hosted URLs. When we opened one, the first thing that loaded was a full-screen white overlay: a spinner GIF, the words “Loading… Please wait” and a pair of “Cancel” and “Continue” buttons. When the spinner cleared, the page settled into an online store populated with product cards and stock photography, branded “ShopEase.” All flagged URLs mirrored this presentation.
Our suspicions peaked because it was notable that the transition from spinner to shopfront happened only after we tried to click the button under the spinner.
Reading the source: A two-key AES gate
After clearing the mousemove gate, the kit runs two decryption stages using the hardcoded keys in the page. First, it decrypts a hidden string to recover the live C2 address. Then it fetches the actual locker from that C2, choosing a Windows or macOS payload, and decrypts that too. The decrypted locker is assembled and displayed entirely from the browser’s memory rather than loaded from a server, so it never crosses the network as an inspectable file. As a fallback, if the C2 is down or it encounters an error while decrypting, it would just stop and keep the storefront visible.
loadSecret() fetch-and-decrypt routine (right).What the victim sees in the browser
The decrypted payload is tailored to the victim’s operating system. On Windows, it impersonates Windows Defender, with a fake “Microsoft Defender Security Center” scan claiming the machine is infected with malware, stacked system dialogs, and a callback number. The macOS branch is the same scam reskinned over a fake Apple storefront. These are typical social engineering tactics used in tech scams, meant to induce panic and a sense of urgency to call the number they flash repeatedly.
In addition to this fake webpage, the locker traps the victim on the screen. The first click anywhere forces the page into full screen with requestFullscreen(), hiding the address bar and tabs so the fake warning fills the whole display. It then hides the mouse cursor and calls the browser’s keyboard-lock API to swallow the Escape key and other exit shortcuts, so the usual ways out stop responding. On top of that, it deliberately degrades the browser, playing alert sounds on interaction and running busy loops that make the page stutter and lag, reinforcing the illusion that the machine is broken. While the victim stays in full screen, a black lockout screen (“Do not restart or operate the computer… call immediately”) flashes over everything, and trying to close the tab triggers the browser’s own confirmation dialog carrying the scam’s message. None of this actually locks the computer, and operating-system controls still work, but together they make a convincing page that pressures the victim into calling the number.
Delivery: paid Google ads at scale
Most traffic comes through Google Ads, as shown by the tracking parameters Google’s ad system appends automatically when a user clicks a Google ad: gclid, gad_source, and gad_campaignid. gclid, the Google Click Identifier, is a unique per-click token that Google Ads assigns through its auto-tagging feature, to attribute a visit back to the exact ad click. gad_campaignid carries the numeric ID of the Google Ads campaign that served the ad, and gad_source denotes the ad surface the click came from. Google’s systems add these on the ad click, not during organic browsing, so finding them on almost all URLs indicates visits came from paid Google ad clicks rather than search results or direct navigation. The clicks also arrive through Google’s own click-redirect (googleads.g.doubleclick.net). Referrer analysis points to high-traffic maps, weather, real-estate, document-hosting, and sports sites; these publishers are not compromised, and the ads run through their normal inventory.
Over a two-week window (August 31 to September 14, 2026) the kit hit at least 619 organizations, and by the geography of the ad clicks, the United States accounts for roughly 62% of the affected organizations, Japan for 16%, and Australia for 14%, with the remainder scattered thinly across a long tail of other countries. We counted more than 250 Google Ads campaign IDs across at least 284 legitimate publisher sites.
Conclusions
This kit is a working example of tech-support-scam operators adopting the same runtime-decryption and anti-analysis tradecraft seen in more sophisticated web threats, such as the CypherLoc scareware Barracuda documented in May 2026.
For the victim, that tradecraft turns an ordinary ad click into a browser that appears to seize up on a fake security warning. The locker fills the screen, hides the cursor, swallows the usual exit keys, and lags the browser, all to manufacture the sense of a broken machine and pressure the person into calling the number on the screen. Nothing on the computer is actually locked, but in the moment it is convincing enough to push people toward the scam.
The best defense is awareness. A legitimate operating system or browser will never lock the screen and demand that you call a phone number, so a page that does is always a scam.
What to do if your computer is stuck on a fake alert?
The safe response is to not call the number, but to close the page. A quick tap of Escape is locked by the locker, but pressing and holding it for a couple of seconds can force the browser out of full screen and release the keyboard lock, after which the tab can be closed. If that does not work, force-close the browser through the operating system, which the page cannot touch: Task Manager (Ctrl+Shift+Esc) on Windows, Force Quit (Cmd+Option+Esc) on a Mac, then reopen without restoring the previous session.
Netskope Detection
Netskope Threat Protection detects this kit inline as Generic.Phishing Tech Support Scam Kit Detected. Because these operators rotate infrastructure quickly and reskin the decoy, we treat this as a moving target: Netskope Threat Labs continues to monitor the campaign and we are expanding coverage across its variants and to other similar cloud-hosted tech-support-scam kits as they emerge.
Indicators of compromise
The full list of indicators for this campaign is published in the Netskope Threat Labs IOC repository.
