Tech Support Scam - "Your device is under threat" - How to remove

“Your device is under threat. Code #007d3Cx0d” is a phrase used by a tech support scam page.

It’s posted on web pages that are designed to look like Windows Defender warnings. They claim that your computer is infected and that it needs to be blocked.

These “Your device is under threat” pages are created by scammers to impersonate Microsoft and to scare people into calling the given phone number. If you see this alert, close the page. “Your device is under threat” is a tech support scam and a phishing scam.

About the “Your device is under threat” scam:

Classification	Tech support scam, phishing, scareware, malicious advertising.
The behavior of the “Your device is under threat” ads	Fake but realistic Windows Defender alerts on web pages, a phone number listed in the fake Action Center, the browser user interface is hidden, making it hard to close the page.
Dangers posed by the scam	Tech support scammers seek to charge victims money and install malware on their devices, victims experience unnecessary stress and have their time wasted.
How to protect yourself from the “Your device is under threat” scam	Block malicious ads, if needed, find and delete malware with real antivirus tools (Spyhunter for PC, Combo Cleaner for Mac, , others).

How “Your device is under threat” scams people

It shows a fake Windows Defender alert

Tech support scams are done by malicious actors pretending to be tech support specialists. These people pretend to fix computers so that they can charge money as payment for their “services”.

But first, they need to convince PC owners that their computers are broken and to call a particular support center to “fix” them. For this purpose, the scammers set up malicious web pages and advertise them online.

One scam page shows a pretty realistic-looking Windows Defender window and an ominous warning:

Your device is under threat

Code #007d3Cx0d

If you click this page, it attempts to go full screen – or at least to hide the user interface (the menu at the top) so that you forget that you can’t close the “Your device is under threat” alert. It also doesn’t allow to right-click or copy any of the text. (You need to press the Esc key to bring back the user interface.)

Then the “Your device is under threat” page plays a spooky audio track. It starts with “important security message”, claims that your computer was “locked up”, tells you to not shut it down. It also says that your device was being used for illegal activity – all lies.

To the right of the “Your device is under threat” Defender window is a fake Action Center. It shows a phone number that you’re supposed to call – the number that will be answered by the tech support scammers responsible for the “Your device is under threat” page.

Here’s what the fake Action Center text says:

Windows Defender found some Malicious Spyware/Riskware. Please call us immediately at:

+1-844-342-2637

Do not ignore this critical alert. If you close this page, your computer access will be disabled to prevent further damage to our network. Your computer has alerted us that it has been infected with a Spyware and riskware.

You must contact us immediately so that our expert engineers can walk you through the removal process over the phone to protect your identity. Please call us within the next 5 minutes to prevent your computer from being disabled or from any information loss.

It pretends to scan your computer

And if you click the “Turn On” or “Yes” button of the fake Windows Defender alert, it opens another fake Defender page. This one starts “scanning” threats and files, steadily raising each number.

Of course, the page is not actually finding any malware on your computer. Webpages can’t see inside our computers (Can a malicious website access the contents of files on a computer?). The “Your device is under threat” page is just making up the numbers of scanned files. Raising “files scanned” by 100 per second and threats found” by 1 per second (if you open up developer tools in the browser, you can see the function that does this).

And hey, at the time of writing, the “Your device is under threat” page says that it’s discovered almost 5 thousand threats on my Mac! Neat.

Now, nothing happens besides the page continuing its pretend scan. The “Your device is under threat” scam wants you to call the phone number listed on the right.

The “Your device is under threat” scam is a bit similar to the Trojan Spyware Alert scam – they both show very high quality fakes of real Windows alerts.

How to deal with the scam

Do not call the number

Overall, the “Your device is under threat” alert creates a very stressful experience. The scammers want people to feel scared and desperate.

Just know that your computer is not in danger. Do not call the phone number that “Your device is under threat” is pushing. The people on the other side just want to take advantage of you:

• Scammers first try to get access to your computer through remote access tools like Fastsupport.
• Once on your device, the scammers show fake errors and logs to try and convince you that there’s something wrong with your computer.
• They install expensive but useless software and pretend to fix things, then demand payment of hundreds of dollars.
• Some scammers also steal files and install adware and spyware.
• If you annoy the scammers, they can try to brick your computer by changing passwords and deleting essential files.

Close the “Your device is under threat” page

If you see the “Your device is under threat” page, close it quickly. Depending on your operating system (Windows, macOS, etc.), the instructions might be a little different – you can find them in our post How to fix locked browser issues.

Close the browser tab, or the browser, or even the computer. Even if there was real malware on your device, shutting down your computer would be the right thing to do in most cases – malware can’t do anything to a computer that is off.

Familiarize yourself with tech support scams (How to Spot, Avoid and Report Tech Support Scams) and tell the people around you what to watch out for.

Protect your device

Malicious pages like “Your device is under threat” can appear because of dangerous ads online. There’s probably nothing wrong with your computer – but if you see obnoxious ads like this often or if you experience other strange browser behavior, it’s advised to check your device for adware.

You can use an antivirus app like Spyhunter for Windows, Combo Cleaner for macOS, Malwarebytes, and others to scan your device and see what the results show.

To avoid the scam, it’s helpful to avoid websites that aggressively show pop-up ads. You could also use ad blockers and anti-malware apps that block malicious sites. They can reduce the number of malicious sites that open on your screen.

Automatic Malware removal tools