Cloud-hosted tech-support scam kit delivered via Google Ads evades detection

Netskope documents a cloud-hosted tech-support scam kit that is delivered through Google Ads and hides behind anti-analysis tricks. The kit presents victims with a fake security locker that imitates a Microsoft Defender lock screen. A separate threat report from Threadlinqs (TL-2026-2651, 7 IOCs, 9 detections) describes the same pattern in the wild: the fake Defender lock traps the victim in fullscreen until they call the attacker's scam hotline.

The story matters because it shows commodity fraud operators abusing paid search ads rather than email lures. A victim who searches for antivirus help can land on the scam page directly, and the fullscreen lock plus urgent phone number pressures them into paying for bogus support or granting remote access. Ads distribution also lends the page false legitimacy and makes takedown dependent on the ad platform rather than on mail filtering.

Watch for continued abuse of Google Ads despite platform enforcement, new kit variants that impersonate other security brands, and whether the published IOCs get broad traction. Defenders should consider blocking or flagging ad routes to support pages, and instruct users that a browser cannot legitimately lock the screen or demand a phone call.