Scareware is a type of malware that manipulates and tricks users into thinking their device is infected, then convinces them to download useless or malicious software. This guide will explain what scareware is, provide examples, and give tips to prevent scareware attacks.
What is Scareware and How Does it Work?
Scareware, also called rogue security software, is a fraudulent tactic used by cybercriminals to profit off of unsuspecting victims. It works by scaring users into believing there is a virus or other cyberthreat on their computer in order to convince them to purchase and download fake antivirus software that is actually malware.
The attack typically starts when the user receives an alarming pop-up notification or email warning them of infected files or a security breach on their device. The message is designed to create a sense of urgency and panic, pressuring the victim to take immediate action to remove the supposed threat.
Scareware notifications often mimic the appearance of legitimate security warnings from well-known antivirus companies. The criminals behind scareware campaigns utilize social engineering techniques to manipulate users by posing as trustworthy sources.
If the user clicks on the pop-up or email, they will be directed to a website urging them to download antivirus software to remove the viruses. However, the software being peddled is either fake or infected with malware itself.
Once downloaded, the rogue antivirus program seems to scan the computer and show the user hundreds of infected files. Then the scareware demands payment for the full software version that will fix all of the viruses. In reality, it is a scam operation designed to extract money from victims.
Common Scareware Tactics
Cybercriminals distribute scareware through various methods aimed at infecting as many devices as possible. Here are some of the most common scareware attack vectors:
-
Pop-up ads: Malicious pop-up windows will suddenly appear with warnings about viruses detected on your computer. The pop-ups are designed to look like security alerts from major antivirus brands.
-
Search engine ads: Scareware vendors will purchase online search ads so their website appears at the top of results for related terms like “antivirus software.” Users clicking on these sponsored links risk downloading malware.
-
Manipulated search results: Hackers will modify search engine optimization tricks to bump rogue anti-malware program websites higher in organic search results.
-
Social media ads: Scareware scammers will also buy ads on social networks that get inserted into users’ feeds. The goal is to reach the largest audience possible.
-
Email phishing: Phony emails pretending to be from well-known tech brands often include links or attachments that download scareware when opened.
-
Software bundles: Some free software downloads bundle scam malware products without the user realizing it. Always carefully read disclosures during installations.
-
Infected websites: Websites compromised by malware can redirect visitors to scareware landing pages to initiate a download.
Examples of Scareware Attacks
To better understand how prevalent scareware campaigns are, let’s look at some real-world examples targeting individuals and major corporations:
-
In 2020, Avast Antivirus estimated tens of millions of scareware attacks were aimed at Mac and Windows users annually. These included pop-ups mimicking warnings from Apple and Microsoft.
-
A scareware scheme known as Mac Defender infected over 60,000 Macs at its peak in 2011. It appeared as a fake antivirus program claiming to find viruses, then demanded over $80 for the full version.
-
The WinFixer scam most heavily targeted Windows users around 2007. Fake error messages popped up prompting users to download WinFixer to remove viruses.
-
In 2008, rogue antivirus software called Antivirus XP 2008 was installed on PCs at large companies like BMW, UPS, and Chase Bank. It seemed legitimate at first glance but was difficult to uninstall.
-
Fake software posing as SecurityShield infected Facebook’s internal network in 2010. Several high-risk pop-up ads on the site were found to be spreading the scareware.
As you can see, scareware operators have managed to infiltrate both consumer devices and major enterprise networks by disguising malware as legitimate antivirus programs.
Identifying Scareware Red Flags
Since scareware messages are expertly designed to induce panic, it can be difficult to discern real threats from fake ones. Watch out for these common scareware red flags:
-
Urgent warnings about infections or hacking: Scareware tries to alarm users with claims that their computer was breached or is severely infected.
-
Instructions to act immediately: Scammers want victims to act quickly without thinking by insisting they download software right away.
-
Spoofed company names and logos: Check that the name, logo, and email address match the real McAfee, Norton, etc. Scareware uses lookalikes.
-
Spelling and grammar errors: Sloppy text mistakes indicate an unsophisticated scam attempt. Legitimate security companies proofread.
-
Too-good-to-be-true pricing: Fake software offered at an unrealistically cheap price should raise suspicions.
-
No license information: Authentic antivirus companies always provide software license details, while scareware won‘t.
-
Password requests: Real antivirus tools won‘t ask for your passwords. Scareware does to steal account info.
Staying calm and watching for these red flags when confronted with a sudden pop-up warning can help users avoid falling into the scareware trap.
Signs Your Device is Infected With Scareware
If you already downloaded suspicious antivirus software, how can you confirm it’s scareware? Here are signs your device has been infected:
-
More frequent crash errors and slower performance: Scareware strains system resources, causing instability and lag issues.
-
New toolbars, bookmarks, and homepage changes: Malware often modifies browser settings without permission.
-
Random new programs installed: Shady apps appearing that you didn’t download likely means malware.
-
Disabled security tools: Scareware blocks real antivirus software from running.
-
Repeated scareware pop-ups: Nonstop fake security warnings indicate rogue software wants you to keep paying.
-
Difficulty removing programs: Scareware frustrates attempts to delete it.
If you observe any of these issues, your computer has likely been compromised by a scareware program.
Removing Scareware from Your Device
If you downloaded a fake antivirus program, uninstalling it quickly is important to avoid malware infection and financial loss. Here are tips for getting rid of scareware:
On Windows:
-
Access the Control Panel, then Programs and Features.
-
Find and select the scareware program.
-
Click Uninstall.
-
Confirm the uninstall, then restart your PC.
If that fails, use Windows Safe Mode to delete the scareware instead:
-
Restart your PC and press F8 before Windows loads.
-
Select Safe Mode with Networking.
-
Open Programs and Features and uninstall the scareware.
-
Restart your computer normally.
On macOS:
-
Go to Finder > Applications.
-
Drag the scareware from Applications to the Trash.
-
Right click the Trash icon and choose Empty Trash.
-
Restart your Mac.
You may also need to reset your browser settings or run a full antivirus scan to check for other malware the scareware may have installed. Removing these programs swiftly can prevent further harm.
Preventing Scareware Attacks
Practicing safe cybersecurity habits goes a long way in keeping scareware off your devices. Here are tips to avoid these threats:
-
Maintain updated antivirus software from trustworthy companies like Norton, McAfee, and Malwarebytes. They can catch scareware before it infects your machine.
-
Enable browser pop-up blockers. This prevents most scareware pop-ups from appearing.
-
Avoid clicking on banner ads and sponsored links. Scareware vendors often distribute their ads on ad networks.
-
Carefully check email senders and treat attachments/links with caution. Scareware is frequently spread through phishing emails.
-
Only download software directly from the developer’s official website. Unofficial sites may bundle scareware.
-
Set software programs to update automatically so you always have the latest security patches.
-
Make regular backups of your data in case malware damages your system.
Staying vigilant against scareware and having robust antivirus protection provides the best defense against these persistent security threats.
Scareware FAQs
What happens if you click on a scareware pop-up?
Clicking on a scareware pop-up will usually redirect you to a malicious website urging you to download fake antivirus software containing malware. In other cases, it may automatically download the rogue security program to your computer without any action needed.
Does scareware actually infect your computer?
In most cases, yes, scareware does infect computers when users download the fake antivirus programs. The rogue software looks like a legit tool but is infected with malware intended to steal financial information, login credentials, and other sensitive data.
Is scareware illegal?
Scareware operations are illegal in many countries due to the deceptive claims they make to defraud victims into paying money or compromising their privacy and security. Distributing malware and breaching computer systems without consent are cybercrimes.
What happens if I pay for scareware removal?
You should never pay money to the operators of a scareware scam. Their software cannot actually detect or remove infections since it is the malware itself. The criminals will take your payment without fixing your computer and potentially access sensitive info like credit cards used to pay.
Can scareware lock your computer?
Yes, some advanced scareware programs contain ransomware elements that can lock your computer. They encrypt your files until you pay a ransom fee that is unlikely to actually decrypt the data. Recovering from scareware ransomware requires professional intervention.
The Bottom Line
Scareware campaigns rely on exploiting user fears of malware infections to distribute rogue antivirus software infected with actual viruses and Trojans. Always stay vigilant against unsolicited security warnings and verify software legitimacy before downloading to avoid becoming the victim of one of these profit-driven scams. Investing in comprehensive antivirus protection can also safeguard your various devices from sustaining damage should a scareware attack occur.
