Fake "Microsoft Defender Security Center" pop-up from a Google ad locks your browser
A Google ad opens a fake "ShopEase" store that turns into a full-screen fake Microsoft Defender alert with a number to call.
- Is it a scam?
- Yes, it's a scam. Microsoft didn't send it, and your computer isn't actually locked. Real Windows warnings never ask you to call a phone number.
- Type
- Fake warning pop-up
- First reported
- September 24, 2026
- Status
- Still active
- Who it targets
- Windows and Mac users who click Google ads, mostly in the US (also Japan and Australia)
- Tools it uses
- Microsoft Defender (impersonated), Google Ads
If a Google ad took you to a shop and your screen then filled with a "Microsoft Defender Security Center" scan, alarms and a phone number, it's a scam. Your computer isn't locked and Microsoft didn't send it. Don't call the number.
Security researchers at Netskope reported this campaign on September 24, 2026. Over two weeks they counted at least 619 affected organizations, and about 62% of them were in the US.
What does the fake Defender pop-up look like?
It starts with a normal-looking Google ad on a busy website, such as a weather, maps, real estate or sports page. When you click it, you first see a white screen that says "Loading… Please wait" with Cancel and Continue buttons. Then it turns into an ordinary online store called "ShopEase".
Once you move your mouse or click, the page changes. On Windows it shows a fake "Microsoft Defender Security Center" scan saying your computer is infected, with several warning boxes stacked on top of each other and a number to call. Mac users see the same scam made to look like Apple warnings.
Why can't I close it?
The page is built to make you think the computer is broken. Your first click switches the browser to full screen, so the address bar and tabs disappear. It hides your mouse pointer, blocks a quick press of Escape, plays alarm sounds and makes the browser lag.
A black screen flashes up telling you not to restart or use the computer and to call right away. If you try to close the tab, your browser asks if you're sure, and that box shows the scam's message too. None of this touches Windows itself.
How do I get rid of it?
- Don't call the number.
- Press and hold the Escape key for two or three seconds. That usually takes the browser out of full screen. Then close the tab.
- If that doesn't work, press Ctrl + Shift + Esc to open Task Manager. Click your browser (Edge, Chrome or Firefox) and choose End task.
- When you open the browser again, don't restore the previous tabs.
Restarting the computer is also fine. The warning not to restart is part of the trick.
I called the number. What now?
The people on the phone want to take your money, get into your computer, or get your personal and banking details. If you're still on the call, hang up.
If you let them connect to your computer, or gave them card or bank details:
- Disconnect the PC from the internet (unplug the cable or turn off Wi-Fi).
- Call your bank from another phone, using the number on the back of your card.
- Change your email password from a different device.
- Uninstall any program they told you to install (Settings, then Apps, then Installed apps on Windows 11, or "Apps & features" on Windows 10).
Our what to do right now checklist walks you through each step, and Someone remotely accessed my computer covers what to check afterward. You can report it at ReportFraud.ftc.gov and at microsoft.com/reportascam.
How to tell it's fake next time
Windows and Microsoft Defender never show a phone number in a warning. A web page that goes full screen, blares alarms and tells you to call someone is always a scam, whatever logo it uses. Be careful with ads in search results and on websites, too, because scammers pay for them like anyone else. More on how these scams work is in our tech support scam guide.
If you or a parent tend to get caught by pop-ups like this, Xcelcor Guardian can help with what comes after the phone call. It holds any new remote connection to the PC (AnyDesk, TeamViewer, Quick Assist and others) until the account holder approves it by email or on xcelcor.com. It doesn't stop the pop-up itself.
Phone numbers, messages and files linked to this scam
Web addresses are written with [.] so they can’t be clicked by mistake. If something you received matches, it’s this scam.
What the message or pop-up says
Microsoft Defender Security Center
Name shown on the fake scan on Windows
Loading… Please wait
White loading screen with Cancel and Continue buttons, shown before the fake shop
Do not restart or operate the computer… call immediately
Black full-screen lockout message, as quoted by Netskope (shortened in their report)
Other signs
ShopEaseName of the fake online store the ad opens first
Questions people ask
Is the Microsoft Defender Security Center pop-up real?
No. It's a web page pretending to be Windows. Microsoft never puts a phone number on a security warning or asks you to call.
My screen is frozen and Escape doesn't work. How do I get out?
Press and hold Escape for a couple of seconds, then close the tab. If that fails, press Ctrl + Shift + Esc to open Task Manager, pick your browser and choose End task. Don't restore the old tabs when you reopen it.
I called the number and let them connect. What now?
Hang up, disconnect the PC from the internet, and call your bank from another phone using the number on the back of your card. Then follow the steps on our checklist.
Do I need to restart my computer?
You can, and it's safe to. The message telling you not to restart is part of the scam. Nothing on your computer is actually locked.
Sources
Last updated