Fake virus pop-ups use scareware to push malware; closing tabs and revoking notifications can stop them

One browser-based scareware strain called CypherLoc has hit more than 2.8 million people since the start of 2026, according to a study from security firm Barracuda cited by Engadget. The alerts often use dramatic wording such as 'Critical Threat Detected!' along with flashing lights, bright colors, alarm sounds, a robotic voice announcing a 'critical Microsoft security alert' or the display of a user's IP address.

The scams can appear as full-screen browser pop-ups or smaller alerts in the corner of the screen through Windows' notification center. Engadget reported that both routes usually follow an unsafe link or a malicious website, although rogue ads can reach users on legitimate pages; clicking a compromised banner can redirect to a fake security warning. Full-screen pop-ups may hide the mouse cursor to make the user think the browser is stuck.

Smaller notifications can arrive after a website is given permission to send them. A site, even a legitimate one, may ask users to click Allow under a false pretext such as 'Click Allow to read more,' after which it can send push notifications through Windows' notification center and make alerts look like official warnings. Approved sites can send notifications even when they are not open, according to the report.

The pop-ups often borrow the names of legitimate security companies and products, including McAfee Security Software or Windows Defender, to raise the chance that users will comply. The goal is usually to gain access to the computer or steal money by directing users to a bogus tech-support phone number, persuading them to download an anti-malware scanner that is itself malicious or asking for payment information. The Federal Trade Commission has flagged a scam that uses fake CAPTCHA requests to install malware, Engadget reported.

When a full-screen virus warning appears, users should not click anything on the page. Engadget advised closing the offending tab through the browser's built-in task manager, using Shift + Escape in Chrome, Edge and Firefox, then finding a tab with an outlandish label such as 'Security Alert!' and ending it with End Task or the X button. F11 exits full-screen mode.

If that fails, the browser should be force-quit. On Windows, Ctrl + Shift + Esc opens Task Manager, where the Processes tab lists active apps; Ctrl + Alt + Del offers another route. Users can sort by Name, right-click the browser and choose End task. If the browser is set to reopen the last session, users should not accept the option to reopen closed tabs, because that would load the scam page again.

Persistent notifications can be addressed by deleting recent cookies and other site data from the browser, with Ctrl + Shift + Del in Chrome and Edge. Users should also review sites allowed to send notifications. In Chrome, the path is the three vertical dots at top-right, Settings, Privacy and security, Site settings, then Notifications; unknown sites can be removed or blocked from the Allowed to send notifications section. Selecting Don't allow sites to send notifications at the top silences all such pings.

Editor's Summary

Fake Windows virus pop-ups are scareware that can lead to malware, bogus support calls or payment theft. Engadget reported that closing the offending tab, force-quitting the browser and revoking notification permissions can interrupt the scam. The Federal Trade Commission has also warned that fake CAPTCHA prompts can install malware.