Privacy Ninja

Convincing ‘YouTube’ Google Ads Lead to Windows Support Scams

Convincing ‘YouTube’ Google Ads Lead to Windows Support Scams

A scarily realistic-looking Google Search YouTube advertisement is redirecting visitors to tech support scams pretending to be security alerts from Windows Defender.

Today, cybersecurity firm Malwarebytes disclosed that they discovered a “major” malvertising campaign abusing Google ads.

When searching for “YouTube” related keywords, the first advertisement shown in search results is titled, ‘YouTube – Best of YouTube Videos’ or ‘ – YouTube – Best of YouTube videos for You.’

Looking at the advertisement, there is nothing that looks suspicious, as it contains the correct URL and also shows additional advertising elements underneath the ad, as shown below.

Also Read: Are Data Protection Impact Assessments mandatory?

Fake YouTube ad in Google search results
Fake YouTube ad in Google search results
Source: BleepingComputer

However, clicking on the advertisement would not bring you to YouTube but rather to a tech support scam pretending to be a security alert from Windows Defender.

From tests conducted by BleepingComputer, the tech support scams are located on the URLs http://matkir[.]ml and http://159.223.199[.]181/ and warn visitors that ‘Windows was blocked due to questionable activity’ and that Windows Defender detected a Trojan Spyware named ‘Ads.financetrack(2).dll.’

Also Read: Accuracy Obligation: What every organization should know

Tech Support Scam shown by Google ad for Youtube
Tech Support Scam shown by Google ad for Youtube
Source: BleepingComputer

For those using VPNs, the good news is that the scam sites will check if you are running a VPN and, if so, redirect users to the legitimate YouTube site.

When we called the number listed on the scam site, we were connected to an overseas call center where the “support technician” prompted us to download and install TeamViewer on our devices.

While we did not allow the installation to continue, they would likely have used TeamViewer to take control of our computer to “fix” the error.

In most cases, the scammers would lock your computer somehow or tell you that your computer is infected and that you need to purchase a support license. Either way leads to an expensive support contract that provides no benefit to the victim.

The malvertising campaign is still running on Google Search at this time as demonstrated by a tweet from Malwarebytes.

What makes this malvertising campaign so scary is that it shows that threat actors can create ads that impersonate companies to distribute malware, phishing pages, or other types of attacks.

BleepingComputer has reached out to Google with questions about the advertisement but has not heard back at this time.



Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection


We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.


Click one of our contacts below to chat on WhatsApp

× Chat with us