Fake Security Alerts Can Trap Your Browser—Here’s the Fix

If a browser suddenly fills the screen with a red security warning and a phone number, don’t call it. In a campaign documented this week, the scary screen wasn’t an operating-system lock or proof of an infection. It was a web page engineered to feel broken long enough to push people toward a bogus support line.

I’d share the exit steps with anyone who regularly asks for computer help. The scam is convincing, works on Windows and macOS, and can appear after an ordinary ad on a legitimate website.

Why the browser feels frozen

Netskope Threat Labs traced the campaign to paid Google ads shown through the normal inventory on maps, weather, real-estate, document-hosting, and sports sites. The publishers themselves were not compromised. Between August 31 and September 14, Netskope counted more than 250 Google Ads campaign IDs across at least 284 publisher sites, with users at 619 customer organizations clicking the ads.

The landing page initially looks harmless. It waits for a mouse movement, a simple check that helps it avoid automated scanners. Only then does the code run two AES decryption stages, retrieve a Windows- or Mac-specific payload, and assemble the warning in browser memory.

JavaScript calls requestFullscreen() to hide the address bar and tabs. The page also hides the cursor, uses the browser’s keyboard-lock feature to intercept common exit keys, plays alert sounds, and runs busy loops that make the browser stutter. That lag is deliberate. The computer still works; the page is performing a convincing imitation of a system failure.

How to close it safely

1. Do not call the displayed number. Do not install a remote-control app or enter payment details.
2. Press and hold Escape for several seconds. Netskope says this can force the browser out of full-screen mode and release the keyboard lock. Close the tab once the normal browser controls return.
3. If that fails, force-close the browser. On Windows, press Ctrl+Shift+Esc, select the browser in Task Manager, and choose End task. On a Mac, press Command+Option+Esc, select the browser, and click Force Quit.
4. Reopen without restoring the previous session. Decline any prompt to restore the closed tabs, or the scam page may load again.

Force-closing can discard an unfinished form or other unsaved browser work. I’d accept that small loss before giving a stranger remote access to the machine.

If you already interacted with the scammer

End the call and remote session. Change any password you revealed, including on other sites where you reused it. Contact your bank or card issuer through the number on the card if money or payment details were involved. Update the computer’s security software and run a scan. The FTC also accepts reports and notes that genuine security pop-ups do not ask users to call a phone number.

Seeing this particular warning did not, by itself, mean the operating system was infected. The pressure to call was the real attack. That distinction is worth remembering: a loud page can look serious while still being just a page.

Share: