What Is Scareware?
Scareware is a social engineering attack that presents a fabricated security warning, most often a pop-up claiming a device is infected, to frighten the target into paying for fake software, calling a fraudulent support line, or installing malware. The claimed infection does not exist, which is what separates scareware from ransomware (real encryption) and spyware (real data collection).
The false claim about the device's state is the core mechanism, and the alert often displays a trusted brand identity the target already trusts.
How scareware works
The attack can begin when malvertising campaigns redirect visitors from legitimate sites to scam pages without a click. Compromised websites carry injected scripts that send first-time or mobile visitors to scareware landing pages. Abused push-notification permissions can also deliver fake desktop alerts that resemble system dialogs (opens in new tab).
Phishing calendar invites do similar work, and users often cannot delete them, or they keep returning because they sync across devices.
The page then impersonates an authority. Common templates mimic Windows Defender or Microsoft Security Center, display fabricated scan results showing multiple infections, and show a phone number to call. Legitimate error and warning messages typically omit phone numbers (opens in new tab).
Pressure follows. Pages go full-screen, lock keyboard and mouse input, play loud audio, and run countdown timers or prosecution threats so the target acts before evaluating anything.
A common brand-impersonation template mimics Microsoft Windows Support: a fabricated block overlay names a specific malware family and demands a call to a "support" number. Anyone who calls reaches a live operator who requests remote access (opens in new tab) through tools such as AnyDesk, TeamViewer, or UltraViewer, then charges for a fake repair and harvests card details through a spoofed refund page.
The operator may also install real malware during the "cleanup."
Why scareware matters
Scareware runs under a real company's name, and that company absorbs the damage. Recent campaigns have impersonated Microsoft, PayPal, DocuSign, Adobe, McAfee, NortonLifeLock, and Geek Squad through emails carrying fake support numbers and QR codes, the callback phishing pattern in its email form.
Tech support scams, the operational form scareware now takes, sit inside the broader category of imposter scams (opens in new tab). These scams cost victims money and damage the impersonated company's reputation and customer trust.
Beyond damaging the brand, the same lures now open enterprise intrusions. ClickFix and CrashFix pages posing as browser errors deliver stealers and remote access trojans. The Interlock ransomware group used ClickFix infrastructure (opens in new tab) for initial access. Treat the pop-up as the entry point to a multi-channel chain that continues over voice and SMS, with email as another channel.
Attackers rapidly replace the infrastructure behind these attack chains. Fast flux DNS rotates through IP addresses faster than denylists update (opens in new tab). Even after defenders take an actor's pages offline, bulletproof hosts can ignore abuse complaints, while shared traffic distribution systems keep routing victims.
Types of scareware
Scareware appears in a few recurring forms:
- Rogue antivirus and fake cleaner apps. Fabricated scan results push a paid "fix" or a cleaner app monetized through in-app purchases. Fake alerts have also run inside mobile games, reading "Apple Security Alert: 8 viruses have been detected on your iPhone. Now iOS is damaged by 72%."
- Browser lockers with callback numbers. Full-screen pages abuse the Keyboard Lock API and history.pushState() loops to block closing the tab while a phone number stays on screen; kits that attackers sell for this purpose start with a phishing email and use encrypted loaders and hash-gated execution to slip past detection before the browser locks. Attackers deliver the same number through trusted channels, abusing Azure Monitor alerts (opens in new tab) for fake billing notices and sending calendar invites claiming a security subscription had renewed, with operators pressing callers to install AnyDesk.
- ClickFix and CrashFix error pages. Fake CAPTCHA or browser-crash prompts instruct the user to open a Run dialog and paste a command that JavaScript has already copied to the clipboard. Windows Update prompts use the same method. A CrashFix variant (opens in new tab) deliberately crashes the browser, then tells the user to run a command to restore it.
- Fake law-enforcement lock screens. Overlays carrying police or FBI imagery accuse the victim of a crime and demand a fine. Flocker tailors its accusations to the local agency and abuses Accessibility Service permissions to survive reboots.
How to defend against scareware
Defense splits into controls on your own endpoints and controls on the external surface where attackers impersonate your brand:
- Enforce browser protections by policy. Keep Microsoft Defender SmartScreen enforced in Edge and turn on the scareware blocker (opens in new tab), which checks pages locally for suspicious full-screen behavior and reports it to SmartScreen. Set Chrome's Safe Browsing to its higher protection level and block pop-ups. In Safari, enable pop-up blocking and fraudulent-site warnings.
- Audit and restrict remote access tools. Through scareware lures, criminals persuade users to download legitimate remote monitoring software, then drain bank accounts, so organizations should audit remote access (opens in new tab) tools and inventory the tools they authorize.
- Train employees on the alert itself. Legitimate vendor alerts typically omit phone numbers, and real support teams rarely initiate contact or ask for gift cards or wire transfers. Employees should reach a company using contact information (opens in new tab) they looked up themselves. Callback and voice simulations test whether that habit holds under pressure.
- Define response triggers. Deeper remediation applies when a user installed software, granted remote access, or entered data; in those cases, reset passwords, run malware checks, reverse charges, and report to IC3.
- Watch the external surface. Monitor for impersonating pages, scam ads, fraudulent app listings, and phone numbers using your brand, report abusive domains to the registrar first per ICANN's guidance (opens in new tab), then to hosts and ad networks, and publish customer advisories explaining that Microsoft's support practices exclude tech support phone numbers from legitimate Windows error messages.
How Doppel helps
Doppel is the Frontier AI-native Social Engineering Defense (SED) platform unifying Digital Risk Protection (DRP) and Human Risk Management (HRM). It dismantles the impersonating pages, ads, and phone numbers behind a scareware campaign while training employees against the same lures.
Brand Protection detects the fake alert pages on lookalike domains and the scam ads that route traffic to them. It also detects the fraudulent app listings that carry a brand's logo. The Doppel Threat Graph connects each spoofed domain and malicious ad to the callback number used by the same operation in a single campaign view, so the platform dismantles the browser locker and the ad buying its traffic together instead of one pop-up at a time.
Doppel's agentic AI executes those takedowns through platform APIs at scale, while analysts handle complex escalations requiring human judgment. On the human side, Simulation runs voice and Helpdesk Mode scenarios that mirror a fake support call.
Request a demo to see how Doppel finds and dismantles the pages, ads, and callback numbers running under your brand.
Frequently asked questions about scareware
What is scareware?
Scareware stages a bogus security alert, usually claiming a device is already infected, to pressure someone into buying worthless software, calling a fake support line, or installing malware. A US federal court filing (opens in new tab) documented the pattern as far back as the WinFixer case: sell software that claims to fix a problem the target never actually had. The infection is invented; current versions add a phone number so a live operator can finish the theft by phone.
What is scareware in cybersecurity?
In cybersecurity, scareware combines malware with social engineering (opens in new tab), using fear to trick people into downloading malware or losing money. It can also lead them to hand over personal data. Some variants install as rogue antivirus programs; many run entirely inside a browser page with no code on the device. For enterprises, scareware can initiate ClickFix intrusions, in which fake error pages instruct users to run malicious commands, as well as callback attacks that impersonate trusted vendors.
What is the difference between scareware and ransomware?
Ransomware encrypts files or locks a device; the damage is real, and payment buys a decryption key. Scareware only claims damage; it encrypts nothing, and closing the browser or restarting the device usually removes the alert. The two overlap in fake law-enforcement lock screens, and some scareware programs can make a device unusable until victims meet their demands. The deciding test is whether actual encryption occurred.
What is an example of scareware?
The Windows Defender browser locker is a common example. These pages lock the screen and play an audible voice telling the user not to shut down. Legitimate Windows errors typically omit phone numbers (opens in new tab) and avoid directing users to call support. Victims should shut the device down immediately and ignore any instruction not to power off; the lock usually disappears on restart. Operators push anyone who calls the displayed number to install remote access software and pay for a repair.