McAfee Blogs

Stop Fake Antivirus Popups on Your Mac

I often hear Mac users say, “Oh, I don’t have to worry about viruses. I have a Mac!” Well, unfortunately, those days came to an end a long time ago. The mass market share of Apple owners tipped significantly in the early 1980s, so that criminal hackers took notice and created fake antivirus pop-ups specifically targeting Macs.

This scam has targeted PC users for years. Cyberscammers are placing links to fake antivirus software in online search results, advertising programs with names like “Mac Defender,” “Mac Security” or “Mac Protector,” and offering to safeguard your computer from online threats. But once you click on the link, malicious software is downloaded onto your machine.

In the background, the program may open up pop-up windows that ask you to upgrade the software for a fee to remove non-existent threats. If you agree to “upgrade,” the cybercrooks get your money, often $50, and you get nothing in return. Or, it may open up pornographic or other undesirable websites. If you fall for these scams, you could end up damaging your computer, losing money, and possibly having your personal information compromised.

In this blog, we’ll take a closer look at how you become a target for these fake antivirus pop-up ads, how to remove them from your device, and some tips to block them moving forward.

What is fake antivirus software?

Fake antivirus software is malicious software that tricks you into believing your Mac is infected with viruses or security threats when, in fact, it isn’t. These deceptive programs, also known as rogue antivirus or scareware, masquerade as legitimate security tools to manipulate you into taking actions that benefit cybercriminals.

On your Mac, fake antivirus pop-up ads typically appear as urgent browser warnings or system alerts claiming to have detected multiple threats on your computer. These fraudulent notifications often use official-looking logos, technical language, and alarming messages like “Your Mac is infected with 5 viruses” or “Immediate action required” to create a sense of urgency and panic.

These scams manipulate you by:

• Requesting payment: They’ll prompt you to purchase their “premium” software to remove the fake threats, often charging $50-200 for worthless programs.
• Providing fake phone numbers: The pop-up ads will display fake support numbers you can call for “immediate technical assistance.”
• Requesting personal information: Once you call the number, the scammer on the other end of the line will request your credit card details, personal information, or remote access to your computer.
• Encouraging malicious downloads: The ads will trick you into downloading actual malware disguised as security software.

Tactics scammers use to infect your device with fake antivirus pop-up ads

Fake antivirus popups are almost always the result of a sneaky delivery method designed to catch you off guard. Scammers rely on ads, compromised websites, misleading downloads, and social engineering tricks to get their scareware onto your Mac without you realizing what’s happening. Let’s take a look at the common ways these scams spread so you can avoid them.

• Deceptive online advertisements: Fake antivirus software often appears through misleading ads that claim your Mac is infected or at risk. These ads can appear on legitimate websites and use urgent language, such as “Your Mac has 3 viruses!” to create a sense of panic.
• Malvertising campaigns: Cybercriminals purchase legitimate advertising space and inject malicious code that automatically redirects you to fake antivirus download pages. This can happen even on reputable websites you trust.
• Drive-by downloads: Simply visiting a compromised website can trigger automatic downloads of fake antivirus software without your knowledge. Your Mac may store these files in your Downloads folder, where they wait for you to accidentally open them.
• Bundled software installers: Fake antivirus programs often hide in free applications from unofficial sources. During installation, you might unknowingly agree to install additional “security” software that’s actually malicious.
• Pirated applications and media: Illegal downloads of software, movies, or music frequently contain fake antivirus programs as hidden payloads. These files install malware alongside the content you wanted.
• Typosquatted domains: Scammers register URLs that are slightly altered or are misspellings of legitimate websites, such as Apple-support.com. These typosquatted links are sent via phishing emails that claim to have detected a virus on your Mac. If you click on the fake link, you could be infected with malware that displays alarming security warnings and promotes fake antivirus downloads.
• Fake technical support pages: Scammers create convincing replicas of Apple Support or legitimate security company websites that promote fake antivirus solutions. These pages often include official-looking logos and professional language to appear trustworthy.
• Browser notification abuse: Some websites request permission to send you notifications, then later spam you with fake virus alerts. Clicking on these notifications could download fake antivirus software that mimics macOS system alerts.
• Malicious configuration profiles: Fake antivirus installers may request permission to download configuration profiles onto your device, granting them deep access to your Mac’s settings and network traffic. Once installed, these profiles will redirect your browser traffic through malicious servers and display fake security warnings.

Elements of a fake virus alert

Fake virus alerts use a mix of visual tricks and psychological pressure to push you into clicking, calling, or paying before you have time to think. This section breaks down the common elements scammers use in these alerts so you can recognize a fake warning instantly and ignore it.

• Blaring alarm and full-screen browser takeover: If your browser suddenly goes full-screen with flashing red warnings and audio alarms, you’re looking at a scam designed to panic you into taking immediate action. Real Mac security notifications never lock your entire screen or play loud, startling sounds. Legitimate macOS alerts appear as small, quiet dialogs in the upper-right corner of your screen.
• Urgent countdown timers: The high-pressure countdown clocks claiming your Mac will be “permanently damaged” in minutes are artificial psychological tactics that scammers use to pressure and prevent you from thinking clearly. Apple’s real security notifications give you time to review and respond thoughtfully
• Spelling and grammar mistakes: Fake alerts often contain telltale errors such as “Your computer has been infected” or “Immediate action required.” Apple invests heavily in polished, professional communications to produce macOS security dialogs with error-free language that reflects the company’s attention to detail.
• Requests for gift cards or cryptocurrency payments: Any request for unconventional payment methods is an immediate indicator of a scam. Apple will never ask you to purchase iTunes gift cards, Amazon cards, or Bitcoin to “clean” your Mac. Authentic Apple security software uses traditional payment methods through official app stores or verified websites.
• Suspicious phone numbers for “tech support”: Scammers use phone numbers that connect you directly with fraudsters who will remotely access your Mac or extract personal information. Legitimate macOS alerts don’t include phone numbers to call for immediate help. Apple provides support through official channels, which are clearly marked on their website.
• Generic or mismatched company logos: Fake alerts often use distorted Apple logos, outdated designs, or generic “security shield” graphics instead of authentic branding. Real macOS notifications maintain consistent visual elements that match your system’s appearance and Apple’s official style guidelines.
• Misleading URLs: Scam pages often use suspicious addresses such as “apple-security-center.net” or “mac-virus-removal.com.” Authentic security alerts from macOS appear in System Settings or from apps you’ve knowingly installed from the official Apple App Store.
• Persistent pop-up ads that won’t close: Fake virus warnings often spawn multiple windows, reappear after being closed, or make it difficult to exit. Authentic macOS security features respect your control and don’t bombard you with alerts.
• Warnings that bypass System Settings: Fake alerts typically appear only as web pages or unauthorized pop-ups that don’t connect to your actual system security settings. Genuine Mac security notifications integrate with your system properly, appearing through official macOS notification systems or System Settings under Privacy & Security.
• Claims “hundreds of viruses found” without scanning: Fake alerts instantly claim to have found dozens or hundreds of viruses without performing a legitimate scan. Real security scans, however, take time to complete and provide specific, verifiable results about actual threats.

Examples of fake antivirus software and pop-ups

• Mac “Defender” variants: This notorious family of fake antivirus programs includes variants such as Mac Security, Mac Protector, and Mac Guard, appearing through deceptive search results or malicious websites. They display fake system scans that allegedly found threats on your Mac to trick you into paying $50-$99 for a useless antivirus tool. Once you enter payment information, cybercriminals will access your financial data and may continue charging your card for bogus services.
• Generic “antivirus” popups: These fake alerts have generic names such as Antivirus 10, Mac Antivirus Pro, or Advanced Mac Cleaner. These ads pop up while you browse, often accompanied by loud alarms and urgent countdown timers, claiming your Mac is infected and demanding immediate action. The scam journey involves clicking the alert, downloading malicious software disguised as security tools, and potentially compromising both your system and personal information.

Verify that an antivirus alert is fake

If you’re not sure whether an antivirus warning is real or just scareware, a quick verification is the safest next step. There are steps you can take and settings on your macOS you can check without putting your Mac at further risk.

1. Disconnect from the internet immediately: When you suspect a fake antivirus alert, the first step is to break the connection between your Mac and the internet to stop malicious processes from communicating with remote servers or downloading additional threats.
2. Check the URL and certificate details: If the alert appeared in your web browser, examine the web address carefully. Legitimate security warnings from Apple or trusted vendors will come from official domains, not URLs with misspellings or random characters.
3. Verify the app’s developer signature and source: To verify that the developer signatures are from recognized companies, open Finder, navigate to Applications, and locate the security software. Right-click the application and select “Get Info” to view the developer information. In macOS Ventura, Sonoma, and Sequoia, you can also go to Apple Menu > About This Mac > More Info > System Report > Applications to view information about the software.
4. Review configuration profiles and login items: Navigate to Apple Menu > System Settings or System Preferences > Privacy & Security to find and remove any configuration profiles you didn’t install. Next, check Login Items & Extensions or Users & Groups > Login Items for suspicious applications set to launch automatically.
5. Inspect LaunchAgents and LaunchDaemons folders: Fake antivirus software often installs persistent components in these system folders. Go to Finder > Go to Folder > ~/Library/LaunchAgents, /Library/LaunchAgents, and /Library/LaunchDaemons. Fake antivirus files typically have .plist extensions.
6. Check browser extensions and notification permissions: Fake antivirus alerts often originate from malicious browser extensions or abusive notification permissions. Review your extensions and remove those you didn’t install or revoke permissions that might be generating fake security alerts.
7. Run legitimate security scans from trusted sources: Use reputable security tools downloaded only from the Apple App Store or directly from the websites of legitimate vendors to scan your system. Apple’s built-in XProtect and Malware Removal Tool (MRT) run automatically, but you can also use the system’s First Aid feature in Disk Utility to check for file system issues.

Your action plan when a fake virus warning pops up

The moment a fake virus warning pops up, scammers are hoping you’ll react fast, click a button, call a number, or download their “fix.” However, the safest approach is the opposite: take a moment to think, don’t interact with the alert, close the browser, and clear any files it may have tried to leave behind. Here’s exactly what to do right away to stay safe.

1. Stay calm and don’t interact with the alert: Resist the urge to click anywhere on the fake virus warning pop-up window, including any “X” buttons, “OK” buttons, or phone numbers. These elements are designed to trick you into downloading malware or connecting with scammers. Avoid touching your mouse or trackpad while the alert is displayed.
2. Force-quit your browser immediately. Press Command + Option + Esc to open the Force Quit Applications window, select your browser (Safari, Chrome, Firefox, or Edge), and click “Force Quit.” If the pop-up has taken over your entire screen, try pressing Command+Q to quit the browser directly. This breaks the connection to the malicious website without triggering any hidden downloads.
3. Clear your browser’s site data and disable notifications. When you restart your browser, immediately go to Preferences/Settings and clear your browsing data, cookies, and cache. Then navigate to the Notifications section and remove permissions for suspicious websites to block the fake antivirus from returning.
4. Check and remove any malicious configuration profiles. Go to System Settings > Privacy & Security > Profiles or System Preferences > Profiles, and look for profiles you didn’t install, especially those with generic names or suspicious publishers. Select unknown profiles and click the minus (-) button to remove them.
5. Restart your Mac to clear temporary threats: A simple reboot helps clear any temporary malicious processes that might be running in memory. After restarting, check your desktop and Downloads folder, move unfamiliar files to the Trash, and empty it completely.
6. Update your macOS and browser to the latest versions: Go to System Settings > General > Software Update and install macOS updates. Update your browsers as well to protect against the latest fake antivirus tactics and browser exploits.
7. Run a full security scan with trusted software: Use reputable security software to scan your entire system for lingering threats. Focus on applications that have been specifically designed for Mac and have current threat definitions.
8. Monitor and validate financial statements: If you provided payment information to what you now suspect was fake antivirus software, immediately check your bank and credit card statements for unauthorized charges. Report these fraudulent charges to your financial institutions and place fraud alerts on your accounts over the next few weeks.
9. Report the scam to protect others: Report the fake antivirus website to the Federal Trade Commission and to Google’s Safe Browsing if you encountered it through search results. You can also report it to your browser manufacturer. Your report helps security teams identify and block these threats more quickly, thereby protecting other Mac users from falling victim to the same scam.

Final thoughts

Your Mac experience should be enjoyable and secure. With the right awareness and tools, it absolutely can be, especially when you know what to look for and follow the right practices. By recognizing the warning signs of fake antivirus pop-ups, downloading software only from trusted sources, keeping your macOS and applications updated, and following the prevention tips outlined above, you can avoid falling victim to these fake antivirus scams.

Remember that legitimate security alerts from Apple come through System Preferences and official macOS notifications, not through alarming browser pop-ups demanding immediate payment or phone calls. Use reputable security tools from a trusted vendor such as McAfee that provides real-time protection and regular updates about emerging threats.

Share these tips with your family and friends, especially those who might be less tech-savvy and more vulnerable to these deceptive tactics. The more people understand how fake antivirus schemes operate, the safer our entire digital community is.

The post Stop Fake Antivirus Popups on Your Mac appeared first on McAfee Blog.