Millions Hit by “Frozen Screen” Browser Scam That Hides in Plain Sight, Barracuda Warns

A well-established type of online scam has quietly gotten a dangerous upgrade. Security researchers at Barracuda have published findings on a scareware operation called CypherLoc — a browser-locking attack that has struck an estimated 2.8 million times since January 2026, and is proving far harder for security tools to catch than its predecessors.

What CypherLoc Does

CypherLoc is an advanced web-based scam that locks a victim’s browser and pressures them into calling a fraudulent tech support number. The attack uses stealth techniques to avoid detection by security tools such as scanners and sandboxes.

The chain of events usually starts with a phishing email. The link opens a page that appears completely normal at first — the attack code is hidden within the page and only activates if specific conditions are met, such as a special code key being present and the user not operating a security scanner or test environment. That conditional trigger is precisely what allows it to slip past automated scanning tools: if the environment looks like a security sandbox, nothing happens. And the conditions are satisfied, the experience turns alarming fast. The page switches to an attacker-controlled full-screen display that locks the browser, disables controls, and shows fake security warnings designed to create panic.

Escape Is Made Deliberately Difficult

The attackers have clearly thought through every avenue a victim might use to regain control. The page slows down or crashes the browser if a user tries to inspect it, hides the cursor, disables menus, and re-locks itself if the user attempts to exit.

On top of the technical lockdown, the scam layers on psychological pressure through loud warning sounds, the victim’s own IP address displayed on screen, fake login forms that don’t function, and repeated error messages — all engineered to manufacture a sense of urgency and panic.

Throughout all of this, a single phone number sits on screen as the apparent solution. Victims who call are connected to scammers posing as legitimate tech support personnel, who continue the attack through social engineering — for example, to harvest credentials.

Why It’s Getting Harder to Detect

Saravanan Mohankumar, Manager of the Threat Analysis Team at Barracuda, summed up what makes CypherLoc a particularly tricky adversary for defenders. “CypherLoc shows how modern scareware is shifting away from obvious malware and towards browser-based, user-driven scams that are difficult to detect and highly effective. It uses the browser itself to pressure victims into acting. By combining hidden code, delayed activation and aggressive on-screen behaviour, it creates a convincing illusion of a serious system problem while leaving very little technical trace.”

That last point matters a great deal. Traditional malware tends to leave footprints — suspicious processes, modified files, unusual network calls. CypherLoc largely avoids all of that. The browser does the heavy lifting, and the victim does the rest.

What to Do About It

Barracuda researchers recommend robust anti-phishing, browser, and endpoint protection capable of detecting and blocking suspicious script behaviour.

But technology alone won’t close the gap. User education is equally important, because legitimate security alerts do not display phone numbers, do not lock browsers, and do not demand immediate action through pop-ups. That simple checklist is worth keeping front of mind: a real security warning from your operating system or antivirus software will never tell you to call a number plastered on a frozen webpage.

The broader shift Barracuda is describing — scareware that ditches malware-style payloads in favour of psychological manipulation delivered through the browser — represents a genuine evolution in attacker tradecraft, and one that puts the onus squarely back on user awareness as a first line of defence.