Scam breakdown

The fake shop that turns into a fake Microsoft alert when you move your mouse

Published 28 September 2026 · SafeHop guides

In short: a new scam uses online ads that lead to a harmless-looking fashion shop. The moment a real person moves the mouse, the page secretly downloads a fake "Microsoft Security" screen, fills the whole display with it, plays an alarm, locks the keyboard and shows a phone number to call. Ad reviewers never see it, because they don't move a mouse. Nothing is installed on your computer: it is only a web page, and you can close it.

What people see

You click an ordinary-looking ad and land on a Japanese-language clothing shop with nice photos and prices.
You move your mouse, and within a second the shop is replaced by a blue full-screen "Windows Security" or "Microsoft Defender" warning.
It claims your PC is blocked and infected, that your bank passwords were stolen, and that you must call "Windows support" immediately.
An alarm keeps playing, the mouse pointer disappears, Esc and F5 do nothing, and trying to close the tab reopens it.

How the trick works

We took one of these pages apart. It is built to show one thing to ad reviewers and security scanners, and another thing to people:

The shop is a decoy. It is a single file in cloud storage. It contains no scam text at all, so automated checks find nothing wrong with it.
The real page is somewhere else, encrypted. The address of a second, hidden server is stored inside the shop in encrypted form, together with the key to unlock it.
A mouse movement unlocks it. Reviewers and scanners usually load a page without moving a mouse. People always move it. On the first movement, the page fetches the encrypted fake alert from the hidden server, decrypts it and places it over the whole screen.
The fake alert then tries to trap you: it switches to full screen, locks the keyboard, hides the pointer, repeats an alarm sound, and if you try to leave, it reopens itself and makes the browser work so hard that it freezes. All of this is meant to make the phone number feel like the only way out.

The same group reuses this design again and again with new addresses. Blocking one address only helps until the next upload, which is why SafeHop looks for the trick itself.

How to escape a fake alert

Press and hold Esc for 2 seconds. Chrome and Edge always let you leave full screen this way, even when a page locks the keyboard.
Then close the tab. (From SafeHop 1.4, you can also click the SafeHop icon and choose Close this page.)
If the browser is frozen, press Ctrl + Shift + Esc to open Task Manager and end the browser (on a Mac: Cmd + Option + Esc). When you reopen it, don't restore the old tabs.
Never call the number. Microsoft never shows phone numbers in warnings, and your computer is not infected by this page.

If you already called

If you let them connect to your computer, disconnect it from the internet and uninstall any remote-access program they had you install.
If you paid or shared card or bank details, call your bank immediately using the number on your card.
Change your important passwords from a different device.
Report it: in Japan, the consumer hotline 188 or the police consultation line #9110; in India, 1930 or cybercrime.gov.in; in the US, reportfraud.ftc.gov.

How SafeHop stops it

At the ad click: an ad that leads to a file in cloud storage instead of a real business website gets a warning straight away.
For everyone, automatically: when such a page shows up, SafeHop's server reads it as text, unlocks the hidden address with the page's own key, confirms the fake alert, and blocks both addresses for every SafeHop user within the hour. No one has to report each new copy. On the day we published this, it caught the group switching to a new hidden server within hours.
When the page swaps itself: if the shop replaces itself with hidden content the moment your mouse moves, SafeHop closes it.
Coming in SafeHop 1.4: SafeHop reads the page's own code on your device and recognises "encrypted, hidden content that unlocks on a mouse movement", so the page is blocked before the fake alert can even load. And if you are already stuck, the SafeHop icon gets a Close this page button that works even when the page blocks your keyboard.

Got a message like this? Paste it into SafeHop's free checker. It reads the wording and every link, and tells you if it looks like a scam, without opening anything. Your message never leaves your browser.

Check a message Get the free extension

More guides

This guide is general safety information, not legal or financial advice. Companies and authorities are named only to show who scammers pretend to be; SafeHop is not affiliated with any of them.