Scareware ads keep running on Google’s transparency tool, even after they’re reported
A team of NYU and Radboud University researchers spent a year building a tool to find deceptive software ads inside Google’s public ad archive. It works. It also exposed something more uncomfortable: reporting a bad ad to Google doesn’t mean the ad, or the domain behind it, stops running.
The tool is called AdLens, and it comes out of a study that mined Google’s Ads Transparency Center, a public database Google built to satisfy transparency rules like the EU’s Digital Services Act.
The researchers pulled 188,000 software-related ad creatives from that archive and ran them through a two-stage detection system: a cheap similarity search to flag likely offenders, then a panel of open-source language models to confirm the verdict. Out of that process came 238 scareware ads, 3,346 ads making false claims, and 258 ads built to hide who’s behind them, together pulling in well over 100 million ad impressions in Europe alone.
What the ads say
The scareware examples read like a script. “Your phone has been severely damaged by 33 types of viruses.” “Storage Almost Full, Insufficient storage may prevent app installation.” One advertiser ran 90 of these flagged ads and had racked up more than a billion ad impressions across its full catalog. These operations are running through Google’s main ad infrastructure, at scale, for months at a time.
The deceptive claims category was even bigger: ads promising to recover photos deleted years ago, or to let a stranger track anyone’s phone location just by entering a number. The most viewed ad in that group had been live for more than two years and pulled in 14.5 million impressions on its own.
The third category, ads designed to obscure who placed them, is smaller in raw numbers but strange in a different way. Some of these ads contain almost no information at all, just a button that says “Continue” or a QR code that leads nowhere identifiable. One French ad using that trick pulled in 1.6 million impressions with nothing on the creative to say who made it or what it does.
Reporting doesn’t mean removal
The researchers didn’t stop at counting. They took a sample of the ads they’d flagged and reported them to Google through the standard “Report this ad” button, using an EU-based account because EU users get status updates on their reports and US accounts don’t.
The results were mixed at best. Some ads came down. Others were acknowledged as violations and stayed live anyway. In one case, Google told the researchers it couldn’t review a scareware ad that was, at the time, publicly visible on the transparency archive and still collecting impressions.
The paper also traced ad landing pages to malicious domains flagged by multiple protective DNS services, including one tied to a known malware campaign called TamperedChef. Reporting a single ad linked to that domain got the ad taken down. The other 41 ads pointing at the same domain kept running.
Ritik Roongta, a researcher at NYU involved in the work, said the team has been trying to get Google’s attention on a fix. “We have been extensively trying to reach out to Google’s trust and safety team to figure out a better way to report these ads and the malicious urls to help in blanket blocking. But we haven’t received any response from them so far,” he said.
Blocking by domain instead of by individual ad would, in theory, close the gap the researchers kept running into. It isn’t simple either. “These urls use variety of different registrars to host their content/payload and even rotate them often,” Roongta told Help Net Security, which means a domain-level blocklist would need constant updating to keep up.
Why it runs cheap
Part of what makes AdLens usable outside a research lab is what it costs to run. The team built it entirely on open-weight models, and Roongta broke down the bill: a 4-core DigitalOcean VM at $96, plus GPU inference charged hourly.
The L40S GPU used for the study cost $1.57 per hour, and the team could complete the LLM annotation in less than 12 hours.
That price tag matters for who can realistically use this. A tool that costs a few dollars to run across nearly 200,000 ads is something a small newsroom, a regulator’s office, or an independent watchdog could plausibly operate on its own, without needing a contract with a major AI vendor.
The team says the pipeline isn’t locked to Google. Roongta said the approach can easily be extended to other ad libraries, including Meta and Amazon, and to other topics, such as healthcare and gambling. “Our pipeline is significantly modular, i.e. it can easily be adapted for other libraries,” he said. The pipeline currently supports text and image ads, and the team plans to add video support in the future. Google’s ad library, run through this pipeline, turned out to hold more than the researchers expected. Whether that changes anything at Google remains, for now, an open question the researchers are still waiting on an answer to.
Download: 2026 Credential Risk Report
