Fake 'virus detected' popup is tricking users into granting remote access

A resurfacing tech-support scam is using a full-screen browser popup styled to look like a system-level security alert, complete with a fake scan animation and a support number, that pressures victims into calling and then installing legitimate remote-access software that hands full control of the computer to the scammer.

How the popup works

The page locks the browser into fullscreen and plays an alarming audio alert, displaying a message claiming the device is infected and personal data is at risk. It cannot easily be closed with a normal click, which several readers said made it feel more credible — a genuine warning would not be this hard to dismiss, but in the moment it reads as urgency rather than a tell.

Calling the listed number connects to someone posing as a Microsoft or antivirus technician, who talks the caller through installing a real remote-desktop tool. Once connected, the scammer has full access to the machine and, in several reports, opened online banking sessions during the call.

How to tell it's fake

• A real operating system or browser never displays a phone number to call for a virus
• The page cannot be closed with a normal click, but can always be exited with a forced browser close (Task Manager on Windows, Force Quit on Mac)
• Legitimate security software never locks your screen or plays an alarm sound

What to do if you see this

Do not call the number. Force-close the browser entirely rather than trying to click out of the popup, then run a scan using security software you installed yourself. If you already granted remote access, disconnect from the internet immediately, uninstall the remote-access tool, and change your passwords from a different, unaffected device — starting with banking and email.

If any payment was made during the call, contact your card issuer immediately and treat it as fraud.