Loading story…
A cloud-hosted tech-support scam campaign used more than 250 Google Ads campaign IDs to route users through a benign-looking fake “ShopEase” storefront before presenting operating-system-specific security lockers impersonating Microsoft Defender on Windows and Apple on macOS. Between August 31 and September 14, it affected at least 619 organizations, chiefly in the United States, Japan, and Australia, with ads appearing across at least 284 legitimate publisher sites. Victims were pressured to call a fraudulent support number through full-screen browser takeovers, keyboard locking, hidden cursors, warning audio, and intentional browser-performance degradation.
The campaign reflects advanced browser-based scareware techniques also documented in CypherLoc, which uses encrypted JavaScript loaders to validate, decrypt, and execute concealed payloads before replacing the initial page with a fake security warning. Such lockers evade automated inspection through interaction checks such as required mouse movement and staged AES decryption of command-and-control details and payloads, while assembling the malicious interface entirely in browser memory. They can further heighten credibility by displaying a victim’s public IP address and fake login forms, while repeatedly relocking the browser when users attempt to recover control.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Between August 31 and September 14, 2026, a cloud-hosted fake security-locker campaign affected at least 619 organizations using 457 scam hosts. The operation used more than 250 Google Ads campaign IDs across at least 284 legitimate publisher sites, with most affected organizations in the United States, Japan, and Australia.
CypherLoc was documented using an encrypted JavaScript loader and runtime page replacement to deploy browser-locking scareware. It forced full-screen behavior, hid the cursor, played warning audio, displayed victims' public IP addresses, and showed nonfunctional credential forms to intensify pressure.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A large-scale scareware and phishing campaign dubbed **CypherLoc** has targeted about **2.8 million people** by steering users to malicious webpages that simulate severe security incidents and pressure them into calling fraudulent support lines. Researchers said the pages abuse browser features to enter full-screen mode, hide the cursor, disable context menus, and display fake alerts, while also showing the victim’s public IP address and counterfeit login prompts to make the warnings appear legitimate. Victims who call are connected to scammers posing as **Microsoft support**, who attempt to steal passwords, banking details, and other sensitive information. The operation relies on social engineering rather than software exploitation, combining phishing emails with browser-locking tactics to create urgency and panic. Reporting indicates the campaign has spread widely since early 2026, with defenders urged to reinforce user awareness around unsolicited emails, links, and attachments and to treat unexpected security warnings and support phone numbers as suspicious, especially when presented through intrusive browser behavior.
Jun 29, 2026
Malicious Google search advertisements were used to impersonate legitimate software and brand websites, steering users to spoofed download pages that delivered **IcedID** malware. In one documented chain, a search for AnyDesk led through Google ad infrastructure and a traffic distribution system to a fake site, `wwwanydesk[.]top`, which served a ZIP archive from Google Firebase Storage containing an MSI installer. The installer abused `rundll32.exe` to launch a malicious DLL export named `init`, installing IcedID through modified legitimate DLLs such as `sqlite3.dll`, `tcl86.dll`, `libcurl.dll`, and `ConEmuTh.x64.dll` to evade detection. Researchers and U.S. law enforcement said the campaign relied on pay-per-click malvertising, cloned websites, and lookalike domains that appeared prominently in search results with little visual distinction from legitimate links. After infection, compromised hosts contacted multiple IcedID command-and-control servers and in some cases pulled follow-on payloads tied to **Cobalt Strike**, **Sliver**, and **DonutLoader**, underscoring the risk of data theft and ransomware. The FBI warned that the same ad-abuse tactic is also being used to steal credentials and cryptocurrency funds, and urged users to verify URLs, avoid downloading software through ads, and report incidents to **IC3**.
Aug 15, 2026
Security researchers reported an active macOS social-engineering campaign that abuses **Google Search sponsored results** and Google-hosted content (notably `docs.google.com`, and also `business.google.com`) to funnel users to **forged Apple Support-like pages** and other lookalike content (including Medium posts). The pages instruct victims—often searching for “mac cleaner” tools or macOS maintenance tasks like clearing cache—to copy/paste an **obfuscated Base64** command into **Terminal**, which then downloads and executes a follow-on script with the user’s permissions. Once executed, the payload can enable remote access and data theft, including harvesting sensitive files and **SSH keys**, and may also deploy additional malware or cryptomining. One report ties the activity to delivery of the **AMOS (aka SOMA) stealer**, which was observed creating artifacts such as `.agent` (AppleScript used to run theft), `.mainHelper` (Mach-O binary), and `.pass` (password stored in plaintext), and attempting to access user data including **Documents** and **Notes**. Researchers also noted the apparent use of **compromised, Google-verified advertiser accounts** to place the malicious ads, helping the campaign bypass ad-platform trust checks.
Jun 29, 2026