Fake Alerts - Your device is currently infected with a Trojan virus! - How to remove

Have you seen a pop-up that says “Important notice. Your device is currently infected with a Trojan virus!”?

Webpages made to look like Apple trojan alerts are being used to trick people into installing junk applications.

These “Trojan virus” pages are designed to look like security alerts delivered by Apple, although Apple never shows alerts like these.

The “Remove Virus” button shown by the alerts leads to a page on the App Store, pushing you to install a promoted app. The alerts falsely imply that the app is an Apple-endorsed antivirus solution. Often, these apps have relatively high subscription fees, that people might be intimidated into paying.

About the “Your device is currently infected with a Trojan virus!” alert:

Classification	Scareware, trojan.
How the “Your device is currently infected with a Trojan virus!” alert works	It impersonates Apple, it says that your device is infected with “a Trojan virus”, it recommends an app to “Remove Virus”, the app is a useless but expensive third-party application.
How to avoid “Your device is currently infected with a Trojan virus!” ads	Use apps to block malicious websites, close suspicious webpages without interacting with them, ask for help online.
How to delete malware	Use anti-malware apps (Malwarebytes, Combo Cleaner, Spyhunter for Mac, others).

What the false alert looks like

You may have encountered alerts saying that your device is infected with a Trojan virus (“Your device is currently infected with a Trojan virus!”) and you have to install an app to solve it. These alerts are nothing more than scams. Scammers collect app subscription payments from people who fell for the fake warning.

The malicious alert might show up while you’re browsing the web. It might also come as a notification from your calendar, browser, or another app.

Here’s what the “Your device is currently infected with a Trojan virus!” warning looks like (or at least one version of it).

Apple Security

Important notice. Your device is currently infected with a Trojan virus!

Your phone’s memory is already having 17% of damage.
Prompt action is required, otherwise,
the device will become defective and all your data
including accounts, photos, and payment data will be
available to third parties.

Immediately install the trusted free app from the AppStore to remove the virus and secure your device.

Remove Virus

Scammers impersonate Apple

It claims to be from Apple Security. It is not, but it’s trivial for malicious actors (or anyone, really) to create a webpage that looks convincingly like another company’s webpage. The URL of the alert is certainly not Apple.com, but again, it’s simple for malicious actors to make it look somewhat believable, like “Applecomsupport.com” or “Apple.com-optimizing-mac.live”.

Impersonating another site is called spoofing (sometimes also phishing).

They threaten your data

The alert says that your device is infected and that it’s being increasingly damaged right now. It also threatens that your data will be leaked to third parties. There might be a timer at the bottom counting down seconds to, presumably, something very bad happening.

Scammers like to create a sense of urgency in order to discourage people from looking for help or getting a second opinion.

They offer a fake solution

The alert then offers a way to “remove the virus” by installing the “trusted free app”. Click the Remove button and an App Store page opens.

The apps pushed by the fake Trojan alert tend to be various VPN and antivirus apps. They also tend to have dozens of glowing reviews, so they might look “trusted” at first glance. However, if you look into their terms of service and home sites, you might notice that these apps are developed by mostly unknown third-party companies and definitely not Apple.

The apps are also not free, despite what the “Your device is currently infected with a Trojan virus!” alert promised; they usually cost at least a few dollars a week, up to a hundred per year.

How to avoid fake virus detections and other malicious ads

Apple’s devices are pretty safe from malware, but not from scams. Scams such as the fake Trojan alert don’t rely on novel programming tricks or security exploits; they just use psychological tricks to scam people.

So, if fake Trojan virus alerts are not a technical problem, how do you solve it?

First, you can use an ad blocker. Not on all sites – most mainstream sites don’t show ads that would lead you to fake trojan alerts. But if you visit pirating sites, free movie sites, video converter sites, etc., then it’s pretty much mandatory to use an ad blocker.

Adware infections, such as bad browser extensions, can also cause malicious advertisements to show up on your screen. If there’s adware on your device, it needs to be removed.

You can also use other tools, like malicious site blockers and anti-malware programs with real-time web security.

But it’s impossible for security tools to catch all malicious websites. So, when you come across a suspicious alert, take a screenshot and post it on a community forum, such as Discussions.apple.com. It’s good to ask for a second and third opinion about these things.

“Your device is currently infected with a Trojan virus!” is not the only fake virus alert that preys on Mac and iPhone users: there are alerts like 27 viruses, 3 viruses, Apple Security Alert pop-ups, and many others.

How to remove malicious apps

To find and delete adware infections, malicious and suspicious apps, and protect your device from malware, it’s helpful to use an anti-malware app like Malwarebytes, Combo Cleaner, Spyhunter for Mac. and others.

If you come across an ad like the “Your device is currently infected with a Trojan virus!” alert, close it without downloading anything from it. If it’s hard to get rid of the unwanted browser tab, check out our post on the various ways to close webpages.

Automatic Malware removal tools