Network Security
Vulnerability Management
Privileged Access Management
Endpoint Security
Threat Hunting
Unified Endpoint Management
Email & Collaboration Security
Contents:
Are you one of those people who get easily scared by pop-up ads and warning messages on your computer? If so, then beware! You might be falling for a common cybercrime tactic known as scareware.
Scareware is a type of malware that relies on a social engineering tactic: it tricks users into believing their system has been infected with viruses or other threats to sell fake antivirus software or gain access to sensitive information. This scam preys on people’s fear of viruses and can lead to financial loss and identity theft if the user provides their credit card information.
In this blog post, we’ll explain how scareware works, why it is dangerous, and explore ways to protect yourself or your organization from this fear-inducing scam. Don’t fall for the fear factor – read on to stay safe online!
How Does Scareware Work?
Scareware, also known as rogueware or fake antivirus software, usually takes the form of a pop-up message or a phony website that looks like a legitimate security program. As with any other malware that relies on social engineering, it is specifically designed to trick you into thinking your computer is infected with a virus, and it will try to prompt you to download and install a “security” program that will remove the imaginary threat.
Of course, the program is actually malware itself, and installing it will give attackers access to your computer and personal information. In some cases, scareware can lead to a ransomware attack, and the threat actors, once in control, might try locking you out of your computer until you pay a ransom.
Even if you don’t install the fake antivirus program, just clicking on the pop-up message can install malware on your computer. And if you do enter your personal information, like credit card numbers or login credentials, cybercriminals can use it to commit fraud or theft.
Why Is It Dangerous?
Scareware often prompts users to download or install software that is actually malicious, such as viruses, spyware, or ransomware. This malware can cause significant harm to the user’s computer, including data loss, system damage, and theft of personal information.
Scareware can be particularly damaging to businesses because it can result in significant financial losses and reputational damage. If an employee falls for the scam and purchases the fake software, it can result in the theft of sensitive information or other security breaches.
Types of Scareware
The most common types of scareware disguise as antivirus software, system optimizers & registry cleaners, and tech support scams. Here’s how they work:
- Rogue antivirus programs – these programs claim to be able to scan your computer for viruses and remove them, but in reality, they are just malware disguised as an antivirus program. Once installed, they will bombard you with fake warnings about nonexistent viruses and try to get you to pay for their “full version” in order to remove them.
- Rogue system optimizers – these programs claim to be able to improve your computer’s performance by cleaning out junk files and optimizing your settings. However, they are actually just malware that can slow down your computer and cause other problems. Again, they will try to get you to pay for their “full version” in order to fix the problems they’ve caused.
- Rogue registry cleaners – registry cleaner scareware promises to fix errors in your Windows registry, which can supposedly help improve your system’s stability and performance.
- Tech support scams – tech support scams often involve scareware pop-ups or messages that claim the user’s computer is infected or has a technical problem. The user is then prompted to call a fake tech support number, where scammers attempt to gain access to the user’s computer or steal personal information.
Scareware Examples
Scareware isn’t a novelty, it has been around for quite some time. Some of the most famous examples include:
NightMare
The first scareware started as a prank – it was called “NightMare”, and it was issued on the Fish Disks for the Amiga computer (Fish #448) in 1991. As NightMare executed, it remained idle for an extended and unpredictable period of time before turning the entire computer screen to a picture of a skull and playing a terrifying shriek on the audio channels. Its purpose was to simply scare its victim, but so it starts, right?
WinFixer
WinFixer was a notorious scareware program that was popular in the mid-2000s. It claimed to be a system optimization tool that could improve the performance of a user’s computer. However, the program would generate fake error messages and pop-up windows, which would scare users into purchasing the full version of the software. The program was eventually shut down by the FTC in 2008.
Mac Defender
Mac Defender was a fake antivirus program that targeted Apple users in 2011. It was designed to look like a legitimate antivirus program and would generate pop-up windows claiming that the user’s computer was infected with a virus. The program would then offer to remove the virus for a fee. The scam was eventually shut down by Apple, but not before it had infected thousands of computers.
Covid-19 Tech Support Scams
There was a nationwide spike in tech support frauds during the Covid-19 outbreak as more people began working from home. Scammers prey on users who aren’t confident in their own remote-accessibility skills by contacting them through phone, pop-up alert, or redirect.
Signs of Scareware
Pop-up messages. Authentic anti-virus software will never send messages through a web browser. If a browser window displays a pop-up window notification, it is not a legitimate notification.
Upgrade requests. The program attempts to convince customers to upgrade to a superior, paid version of their software.
Malvertising. True antivirus software would never promote fear-based alerts. The scarier something appears, the more likely it is that it is fake.
Lack of access to the system or files. Users cannot access legitimate antivirus websites, or they see error messages and prohibited paths when attempting to access other files.
Reduced performance. Malware can slow down a computer’s performance. A user may encounter sluggishness, crashes, or freezes.
How to Remove Scareware
- Turn off the wireless connection and remove the device from any networks it may be connected to.
- Don’t believe the messages displayed by the scareware, no matter how alarming they may seem.
- If you are using a company-issued computer, get in touch with the IT department for guidance.
- Use legitimate anti-malware software: Use trusted anti-malware software to scan and remove any traces of the scareware.
- Take it to a qualified computer technician if the scan finds any evidence of infection. Even if the computer or mobile device seems to be functioning normally, you should not use it or let it connect to a network.
How to Prevent Scareware
Preventing scareware can be tricky, as it is disguised as a legitimate warning or message from your computer. However, there are a few things you can do to protect yourself:
- Be suspicious of any unexpected pop-ups or messages, even if they appear to come from a trusted source. If you didn’t initiate the action, don’t click on it!
- Keep your security software up to date. This will help ensure that you have the latest protection against malware and other threats.
- Don’t click on links in email messages unless you are absolutely sure they are safe. Many phishing scams use email as a way to lure victims into clicking on malicious links.
- Think twice before clicking on ads, especially if they seem too good to be true. Advertisements are one of the most common ways that scareware is spread.
Additional steps are advised for businesses:
- Use robust antivirus: Make sure your business has the most up-to-date and reliable antivirus installed on all devices. This will help protect against scareware and other types of malicious software.
- Use a pop-up blocker: Install a pop-up blocker on your web browser to prevent unwanted pop-up messages from appearing. This can help prevent employees from accidentally clicking on scareware messages.
- Keep your software up-to-date with the latest security patches: Regularly update your software, including your operating system, web browsers, and other applications. This will help patch any vulnerabilities that could be exploited by scareware and other types of malware.
- Educate your employees: One of the best ways to protect your business from scareware is to educate your employees on how to recognize and avoid it. Teach them how to spot suspicious pop-ups or ads that claim their computer is infected, and instruct them never to click on these messages or download any software from them.
How Can Heimdal® Help?
To remove but also prevent a scareware attack, you’ll first need a solid antivirus. Our Heimdal Next-Gen Antivirus + XTP with MDM is a next-generation antivirus solution that includes four cutting-edge malware detection layers as well as live process monitoring. In addition, it runs in the background without slowing down the workstations in your network, which is always a plus.
And, of course, if you want to build on top of that and create a multi-layered cybersecurity strategy, you can also try our Patch and Asset Management: a fully automated solution that enables on-the-fly patch and update deployment from anywhere in the world and Ransomware Encryption Protection: our ransomware-dedicated product that rapidly detects programs that initiate file encryptions and our DNS protection solution – Threat Prevention, which employs artificial intelligence to identify future attacks with 97% accuracy, monitors user traffic in real-time, and blocks malicious sites, preventing communication with cybercriminal infrastructures. Did you know that 91% of malware leverages DNS?
Heimdal® Next-Gen Endpoint Antivirus
- Multiple layers of detection.
- Enhanced Brute-Force Protection.
- Remote device control with MDM.
Wrap Up
Scareware is a dangerous form of malware that preys on unsuspecting users by exploiting their fears. By educating yourself about this type of attack, you can protect yourself from falling prey to it. Learning to recognize its signs and understand what steps you should take if it happens to your device is essential to keep your data safe and secure online.
To prevent it from happening in the first place, remember that it’s important to use reputable antivirus software, keep your software and operating system up-to-date with security patches, and be cautious when downloading or installing any new software or apps.
And if you liked this article, follow us on LinkedIn, Twitter, Facebook, and YouTube for more cybersecurity news and topics.
Madalina, a seasoned digital content creator at Heimdal®, blends her passion for cybersecurity with an 8-year background in PR & CSR consultancy. Skilled in making complex cyber topics accessible, she bridges the gap between cyber experts and the wider audience with finesse.
