The browser fills the screen, the alarm starts, and there is a phone number

Nothing on your computer is locked. That is the first thing to know, because the entire purpose of the screen in front of you is to convince you otherwise: a full-screen Microsoft Defender warning, no address bar, no cursor, the Escape key doing nothing, a siren playing and the browser deliberately grinding.

Netskope Threat Labs has published a breakdown of the kit that produces it, and the scale is the surprising part. More than 250 Google Ads campaign IDs feed it. The ads ran on at least 284 legitimate publisher sites covering maps, weather, property and sport, and the operation spread itself across 457 separate scam hosts. Between 31 August and 14 September the researchers watched people at 619 organisations click through. About 62 percent were in the United States, then Japan at 16 percent and Australia at 14.

Click one of the ads and you get a loading spinner, then a thoroughly unremarkable online shop called ShopEase. Nothing happens next until the page notices your mouse move, because an automated scanner never moves a mouse. That single movement sets it off: the page decrypts a hidden address, downloads a payload built for whichever system you are on, and assembles the fake alert in memory. Windows visitors get a counterfeit Defender. Mac visitors get a counterfeit Apple.

To get out, hold Escape down for a few seconds to leave full screen, then open Task Manager with Ctrl+Shift+Esc and end the browser. When you reopen it, decline the offer to restore your previous session. The real damage only begins if you ring the number, because the person who answers wants to install a remote-access tool and will stay on the line until you let them. If that has already happened, Tendvane's safety check goes through what is installed and running and flags remote-control software you did not choose to put there.