What is a fake antivirus? Explaining rogue security software and how to protect yourself

Have you ever been surfing the web and come across a scary warning claiming that you have a virus? While this can be alarming, more than likely it’s a malware alert for fake antivirus software. This scam, also known as rogue security software, fake antispyware, or smitfraud, is a type of malware that imitates real antivirus software by running phony security scans and displaying fake computer virus warnings on your device.

Scammers design these warnings specifically to scare you. After convincing you that your computer is riddled with a nonexistent virus, the fake antivirus pop-up usually offers to remove it (for a price, of course) or install a fake antivirus program that’s actually Trojan.

While this type of scam has been around for decades, it’s now evolving through new delivery channels. According to a recent Gen Threat Report, malicious push notifications infected with malvertising software saw a 317% increase in the period between April and June 2025. In the most common example found by Gen researchers during that period, a malicious push notification mimicked a regular CAPTCHA page. Once users clicked the “I’m not a robot” box, they were nearly immediately bombarded with fake antivirus pop-ups.

How does fake antivirus software work?

Fake antivirus software works by tricking unsuspecting targets into believing their computer (or other device) has been infected with a computer virus or other type of malware. Scammers hope that the resulting panic makes victims more likely to click the fake antivirus alert, thereby launching the attack.

Here’s a full breakdown of the chain of events that can lead to an infection or scam via a fake antivirus pop-up:

1. The hook: You’re browsing the internet and, suddenly, a flashy, urgent pop-up appears. “Warning! 48 Viruses Detected!” is emblazoned on your screen, or a fake progress bar pops up showing that some behind-the-scenes tool is currently “scanning” your hard drive.
2. The scare: The fake software pop-up then lists dozens of “critical threats,” which are actually just random files or made-up file names, causing you panic. This is a common scareware tactic.
3. The click: To fix or remove these threats, the software tells you to click the notification and upgrade to a premium product. In reality, the product either doesn’t exist, or your click launches a malware infection.
4. The consequences: Once you pay, the scammers have your credit card info. Even worse, the software could be spyware that can now log and exfiltrate your keystrokes or steal your passwords.

How can my computer become infected with a fake antivirus?

You can run into fake antivirus scams almost anywhere online.

Commonly, scammers exploit vulnerabilities in legitimate, high-traffic sites to inject malicious code, so that when you visit a compromised website, it triggers a drive-by download and rogue security software is installed.

When you download tools intentionally, you might also be getting bundled software without realizing. Sometimes, this is full-blown adware, which displays annoying pop-ups for fake antivirus, and is designed with eye-catching colors or countdown timers until the offer to “remove” the virus expires, catching your attention and pressuring you into acting (and clicking) fast.

Some malicious software hijacks your browser, changing your homepage or redirecting your searches. Browser hijackers like this are frequently used to force-feed users fake virus notifications and pop-ups that appear directly in the browser.

SEO (search engine optimization) poisoning means manipulating search engine results into showing fraudulent antivirus tools at the top of the list. Fake antivirus scammers do this to trick you into clicking what looks like a helpful link, but you’re actually getting redirected to a site housing fake antivirus tools.

Similarly, search results (and phishing emails) can serve spoofed websites, which are fraudulent sites designed to look identical to a trusted brand’s homepage. While you may not be able to tell the difference right away, or at all, some of these fraudulent sites are what Norton researchers call VibeScams (fake, AI-generated phishing sites that look nearly identical to trusted sites), and may trick you into manually downloading a fake antivirus.

Fake antivirus scams can also appear in ads or posts on social media sites. Gen research reports that malicious advertising accounts for nearly 30% of scam incidents across social media, and one persistent tactic is impersonating marketing campaigns of legitimate companies.

Emerging threat: Rogue affiliate fraud

Not every fake virus alert is trying to get you to download malware. Some scammers use rogue affiliate marketing to sell you legitimate, high-quality software through dishonest means.

Affiliate marketing is a common and legal business practice. It’s a performance-based system where a company pays a partner (the affiliate) a commission for every customer they refer to the company’s website. For example, a tech blogger might review a laptop and include a link to buy it; if you click that link and purchase the laptop, the blogger gets a referral fee.

Signing up to become an affiliate for a legitimate brand is usually as easy as filling out a short application. Companies often outsource their affiliate programs to third-party networks, and require little vetting of how the applicant actually plans to promote the product. That low barrier is what lets rogue affiliates get their hands on a legitimate tracking link (the method for actually tracking affiliate sales and commissions) in the first place, with nothing stopping them from using it in a deceptive campaign instead of an honest review.

Here’s how rogue (or, “fraudulent”) affiliate marketing works:

1. You see a terrifying, fake pop-up warning or email saying that your computer is infected or your subscription has expired.
2. When you click “Renew” or “Fix Now” (or whatever the urgent call to action is), a tracking cookie is dropped in your browser and you’re redirected to a legitimate antivirus brand’s website.
3. If you buy the software, the rogue affiliate receives a commission, the same as any legitimate affiliate would — the antivirus company never has to know that the customer was tricked into clicking.

Even though you end up with real software, the initial alert was a lie that was designed to manipulate you.

Common signs of a fake antivirus

As you browse the web, keep an eye out for fake antivirus warning signs like random pop-ups and suspicious messages. Here are some other red flags to watch out for:

• Urgent language: If the wording in a random pop-up is oddly aggressive,  urgent, confrontational, like “your device is damaged from recent visits to adult sites”, this is a big sign of a fake antivirus.
• Claims that you have an absurd number of infections: Often, fake antivirus program alerts aim to send you into a panic by claiming you have a huge number of infections on your computer. So if you see a pop-up that says you have 789 virus infections, it’s probably just a fake antivirus and you can ignore it.
• Requests for money: If the virus alert includes a request for payment or reroutes you to a strange-looking checkout page, it’s likely you’re dealing with rogue antivirus software. To be safe, never give your payment information to unfamiliar websites.
• Prompts to fix your “infection” from within your web browser: If the phony antivirus software appears in your browser, you’re likely dealing with a scam. These fake viruses may also include animations that make it seem as if your computer is crashing.

What to do if you see fake antivirus software alerts on your devices

Just because you see fake antivirus alerts, it doesn’t mean you have an active infection — especially if the alerts show up in the form of online pop-ups or in an email.

If a fake virus alert appears as a pop-up or ad, don’t click the pop-up window or ad, even to close it. Clicking the pop-up can trigger a malicious install and put you and your personal information at risk. Instead, close the overall browser window (if that’s where you see it) or hit Ctrl + Shift + Esc on Windows to open Task Manager, then right-click your browser and choose End task.

If you receive a virus alert via email, especially if it’s from a company you don’t remember installing a product from, don’t open the email, and especially don’t click any attachments or links. Instead, ignore it and report the email as spam and block the sender.

But if the alerts are showing up on your desktop or within a program you know you’ve installed, follow these steps to remove the virus.

How to remove fake antivirus software

If you don’t realize the antivirus alert is phony until after you’ve downloaded the fake program, you’ll need to act quickly to remove the malware from your device. While the exact steps may vary by operating system, here are the core instructions:

1. Immediately disconnect from the internet and shut down your computer. This may help keep the virus from spreading to other devices on your network.
2. Restart your computer in Safe Mode so that only the operating system and software essential to run it will start up. Ensure to disconnect your ethernet cable or Wi-Fi while your PC is in Safe Mode.
3. Manually locate and uninstall the fake program if you know exactly what it is. If not, jump to the next step.
4. While in Safe Mode, run a trusted virus scanner and remover tool.
5. Once the scan is complete, restart your computer normally. It’s a good idea to run another virus scan just in case.
   

If the fake antivirus software is still serving you pop-ups, remove your browser extensions and only freshly reinstall the ones you trust, or do a full browser reinstall. If that doesn’t help, you may need to do a full reinstall of your operating system — just be sure to back up only hand-picked important files first, or you risk reinfecting your device after reinstalling.

How to protect yourself against a fake antivirus infection

The most effective way to handle a fake antivirus scam is to prevent it from ever reaching your screen. Here are a few additional tips to help ensure your device is protected from future attacks.

• Avoid opening suspicious pop-ups: Never click a pop-up that claims your computer is infected. Instead, close your browser entirely. If you’re concerned, open your legitimate antivirus software directly to run a manual scan.
• Use a firewall: All popular operating systems come with a built-in firewall. To ensure you’re browsing the internet as safely as possible, enable it or choose an advanced tool like Norton Smart Firewall.
• Ignore emails from suspicious senders: Phishing emails are a primary means of delivering rogue software. Emails that create a sense of urgent panic about your device’s health are likely a scam.
• Monitor your network: An unsecured Wi-Fi connection lets cybercriminals easily snoop on your activity. Secure your network and use a VPN to encrypt your online activity after an antivirus scam.
• Keep operating systems updated: Always install the latest software updates and security patches. These updates patch vulnerabilities in outdated software that scammers use to initiate drive-by downloads on compromised websites.
• Invest in real antivirus software: Download a trustworthy antivirus program and run regular full scans. This not only helps you remove existing threats but also protects you from future fake virus alerts, malware, viruses, spyware, and other cyberattacks.

Heeding these tips will leave you with a cleaner system that’s well protected from future cyberattacks.

Protect your devices and information with Norton

One of the best ways to avoid fake antivirus scams and protect your devices is to use trusted, multi-layered security. With reputable software installed on your device, you’ll have peace of mind knowing you’re already protected, while the software itself works in the background to proactively block deceptive fake virus alerts before they reach you.

As a security solution, Norton 360 Deluxe offers a 100% Virus Protection Promise, giving you the confidence that your devices are monitored by experts. It also features scam detection and a VPN functionality to help block even the most sophisticated fake antivirus schemes.

FAQs

What information are scammers looking for with a fake antivirus?

Scammers are looking for any personal information they can get their hands on, including credit card details, usernames, passwords, and personal files.

What is an example of a fake antivirus software?

In a Norton tech support scam, a hacker sends you an email that appears to be from Norton, stating that your computer has been infected and that you need to contact the helpline. These are not real. However, when you call the provided number for help, they aim to gain remote access to your computer and use it to install malware or steal your personal info. Being aware of Norton email scams makes you less likely to fall for them.

How can I protect myself against fake antiviruses?

Be cautious online and avoid clicking suspicious pop-ups and links. Doing this is best practice for protecting yourself from fake antivirus infections and a host of other cyberthreats. You should also use a firewall, keep your operating system up to date, and install a trusted antivirus program.

I fell for an antivirus scam. What should I do now?

You should immediately take steps to limit the damage and remove the malware or spyware from your device. Steps to take after being scammed can include contacting your bank, uninstalling the fake program, restarting your computer, and using trusted antivirus software to scan your device for malicious software.