Netskope tracks 250 Google Ads campaigns delivering browser-locking scareware across 284 publisher sites August 31–September 14

The campaigns placed malicious creatives on high-traffic maps, weather, real-estate, and sports domains. Once clicked, the payload rendered full-screen overlays that disabled cursor movement, blocked exit keys, and introduced artificial lag to simulate system failure. Netskope blocked all observed traffic before users reached call centers, yet the technique demonstrates repeatable ad-to-lock conversion at scale.

Data from the 15-day window show 284 legitimate publishers serving the ads under 250 distinct campaign IDs. Geographic distribution concentrated in the United States, Japan, and Australia. Prior incidents, including the 2022 malvertising clusters documented in Google’s own threat reports, followed identical publisher-side insertion patterns, indicating persistent gaps in creative and landing-page review pipelines rather than isolated failures.

Coverage has emphasized victim susceptibility while understating the operational reality: ad platforms continue to monetize inventory before behavioral or static signals trigger removal. The absence of mandatory sandboxed execution checks for ad creatives allows rapid iteration by operators who rotate domains and campaign IDs faster than takedown latency.

Google Ads policy enforcement will face measurable pressure as detection thresholds tighten. Expect increased use of ephemeral domains and cloaked landing pages within the next 60 days unless creative rendering is moved to isolated containers with mandatory behavioral logging.