VPN Update pop-up scam (Virus removal guide)

What is VPN Update SCAM?

VPN Update pop-ups are a phishing SCAM that uses social engineering techniques to trick unsuspecting victims into installing unnecessary, unreliable or even malicious software. Such scams often contain logos, brands, names and graphics of real products or companies to give the impression of legitimacy; and this scam is no exception. The “VPN Update” scam is disguised a system alert, but is in no way associated with Apple, Google, Microsoft or their products.

QUICK LINKS

• What is VPN Update SCAM?
• Why is my browser being redirected to the VPN Update scam?
• Removal
• Protection

VPN Update Scam in detail

The VPN Update scam pops up on the web-browser and displays the following message on the screen:

VPN Update
Please download the free VPN app from the Apple Store to continue watching in safe mode

It claims that to continue watching in Safe mode users must install a free VPN app. The whole idea of the scam is to lure users to install third-party apps by clicking on a download link or button. Once clicked, users are redirected to a legitimate Apple Store page that offers to install/purchase a VPN app. Scammers earn a commission for every sale from this page.

“VPN Update” can promote legitimate software, but is more often similar scams are used to distribute untrustworthy and unreliable programs among which may be fake antivirus software, spyware, trojans, browser hijackers, adware and other malicious software.

In addition, the scam can be used to gain bank account details, or passwords to personal accounts such as social media and email. The collected data can be used to make unauthorized transfers
and fraudulent purchases. Moreover, the criminals can use stolen email addresses and phone numbers to send spam and malspam (spam emails containing malware or links to malware).

In some cases, the scam asks users to allow it to display browser notifications. If enabled, it will deliver spam notifications promoting untrustworthy/dangerous pages, various types of scams, and even malware.

Here are some examples of the spam notifications:

To summarize, “VPN Update” pop-up is SCAM! The scam can lead to malware infection, loss of data, financial losses, theft of personal information and other serious problems.

VPN Update SCAM example #2

In another version of this scam, scammers display a fake pop-up message that claims VPN update is recommended.

Text presented in the scam message:

●●●●● 19:05

VPN update is recommended
Your browser might not display the webpage correctly.

Please install the recommended free VPN app to solve a potential problem.

Cancel Install

VPN Update SCAM example #3

“VPN highly suggested for this site” is yet another variant of the VPN Update scam. The goal of scammers is to trick users into downloading malware, stealing or acquiring their private information.

Text presented in the scam message:

VPN highly suggested for this site
Your browsing, streaming and download activity may be not private and may be unsecured.

Cancel Instal

VPN Update SCAM example #4

Another variation of this scam. It mimics the iPhone interface and encourages users to install a VPN, so without it the browser will not be able to display the webpage.

Text presented in the scam message:

VPN update required

Your browser cannot display the webpage.

Please download the recommended free app to solve this problem.

Installing will take about 10 seconds.
Cancel
Install

VPN Update SCAM example #5

There is a variant of this scam that mimics Facebook on iPhones. The VPN Update iPhone scam spreads via Facebook.

Text presented in the scam message:

VPN Update

Please Download The VPN App to browse the web anonymously

Threat Summary

Name	VPN Update
Type	phishing, scam, fake alerts
Associated domains	system-update.fs47vp8old0i.top, apple.z232tadh8hrc.top, apple.0kal38g35ctc.top, apple.zkcb6kowfdag.top, security-update.2c4p24o6zp0y.top, safetydatareport.com, peachlandus.com, allbestsecureus.com, peachlandeu.com, peachlandcn.com, mybestsecurecn.com, berrigroun.com
Distribution	hacked websites, malicious links, push notifications, adware, potentially unwanted programs
Symptoms	spam notifications, fake security warnings, fake system messages, pop-up errors, fake Windows Defender (Norton, McAfee) computer scan
Removal	VPN Update removal guide

Examples of such scams

The VPN Update scam isn’t the only one on the Internet that aims to trick users into installing malicious software. We have already reported on such scams many times: VPN Recommended, Cleaner Update for Android is Recommended, Install the extension for Chrome to protect your privacy, Update Your Chrome browser extension.

Why is my browser being redirected to the VPN Update scam?

Usually, users end up on “VPN Update” and similar scams by going to a misspelled URL or, clicking on a fake link from push notifications and spam emails. In addition, they can be redirected to this scam by malicious advertisements (malvertising) and Adware.

Push notifications are originally developed to alert the user of recently published news. Cyber criminals abuse ‘push notifications’ to display annoying ads. These ads are displayed in the lower right corner of the screen urges users to play online games, visit scam pages, install malicious browser add-ons & so on.

Adware is a form of malicious software designed to display unwanted advertisements to computer users. Some examples include pop-up advertisements, push notifications, unclosable windows and even fake virus alerts. Adware software can be installed onto personal computers via infected web pages, when users open email attachments, anytime they download and install free software.

If the VPN Update scam keeps popping up on the device screen and, after closing it, it appears again and again, then try the following simple steps to solve the problem: turn on pop-up blocker; turn on fraudulent website warnings; delete web browsing data. Below we will demonstrate how to do this.

Open the Apple device settings, then scroll down the list of settings to Safari, tap on it.

In the list of settings, find switches “Block Pop-ups” and “Fraudulent Website Warning”, check if they are enabled. If any of the switches are off, then it must be turned on. Having done this, scroll down the settings and tap “Advanced”.

On the Advanced settings screen, tap “Website Data”, scroll down the list of web-domains and tap “Remove All Website Data”.

How to protect against the VPN Update scam

To avoid becoming a victim of scammers, it is important to always keep in mind:

• NEVER share your personal information.
• Never trust scam sites, don’t click links and buttons they contain, it can be dangerous for you and your computer.
• Close the VPN Update pop-up as soon as it appears on your device screen. Scammers can prevent you from closing it in various ways. In such cases, close your browser using the App Switcher (Open the App Switcher, Tap and hold on the web-browser until the red circles with a minus sign appears. Tap the minus sign on it to Force Quit the web-browser). If the next time you launch the browser, it prompts you to restore the previous session, abandon it, otherwise this scam will reopen on your screen.
• Use an ad blocker when browsing the internet. It can block known scam sites and protect you from scammers.

How to Remove VPN Update pop-up scam (Removal steps)

If you have consistent pop-ups or unwanted advertisements, slow/freezing MAC issues, you are in need of adware software removal assistance. The steps below will guide you forward to get VPN Update pop up scam removed and will help you get your machine operating at peak capacity again.

To remove VPN Update pop-up scam, use the following steps:

1. Remove malicious profiles created by PUPs
2. Check the list of installed software
3. Remove adware related files and folders
4. Scan your Mac with MalwareBytes
5. Remove VPN Update pop-ups from Safari, Chrome, Firefox
6. How to stop VPN Update pop-ups

Remove malicious profiles created by PUPs

PUAs and Adware can install a malicious configuration profile on the Mac system to block changes made to the browser settings. Therefore, you need to open system preferences, find and delete the profile installed by the adware.

Click Apple menu ( ) > System Preferences.

In System Preferences, select Profiles. if there is no Profiles in the list of preferences, that means there are no profiles installed on the Mac. If there is Profiles in the list, then click on it, then select a profile related to malware.

To delete a malicious profile, click on the minus button ( – ) located at the bottom-left of the Profiles screen.

Check the list of installed software

One of the first things to attempt for removal of adware software is to check your Mac computer installed programs screen and look for unwanted and dubious programs. If there are any programs you do not recognize or are no longer using, you should delete them. If that doesn’t work, then you may need to use malware removal utility such as MalwareBytes Free.

Open Finder and click “Applications”.

Very carefully look around the entire list of applications installed on your computer. Most likely, one of them is a malicious app responsible for the VPN Update pop-up scam. Once you’ve found a dubious, unwanted or unused program, right click to it and choose “Move to Trash”. Another method is drag the program from the Applications folder to the Trash.

Don’t forget, select Finder -> “Empty Trash”.

Remove adware related files and folders

Now you need to try to find adware related files and folders, and then delete them manually. You need to look for these files in certain directories. To quickly open them, we recommend using the “Go to Folder…” command.

Click on the Finder icon. From the menu bar, select Go and click “Go to Folder…”. As a result, a small window opens that allows you to quickly open a specific directory.

Check for adware generated files in the /Library/LaunchAgents folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchAgents

This will open the contents of the “/Library/LaunchAgents” folder. Look carefully at it and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files: com.machelper.plist, search.plist, macsearch.plist and installapp.plist. Most often, PUPs, adware software and browser hijackers create several files with similar names.

Check for PUPs generated files in the /Library/Application Support folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/Application Support

This will open the contents of the “Application Support” folder. Look carefully at its contents, pay special attention to recently added/changed folder. Move all suspicious folders to the Trash.

Check for Adware generated files in the “~/Library/LaunchAgents” folder

In the “Go to Folder…” window, type the following text and press Go:
~/Library/LaunchAgents

Proceed in the same way as with the “/Library/LaunchAgents” and “/Library/Application Support” folders. Look for suspicious and recently added files. Move all suspicious files to the Trash.

Check for PUPs generated files in the /Library/LaunchDaemons folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchDaemons

Carefully browse the entire list of files and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files to be deleted: com.macsearch.plist, com.installapp.plist, com.machelper.plist and com.search.plist. In most cases, browser hijackers, adware and potentially unwanted programs create several files with similar names.

Scan your Mac with MalwareBytes

You can delete Adware related files automatically with a help of MalwareBytes. We recommend this free malicious software removal utility because it can easily delete potentially unwanted programs, toolbars, adware software and browser hijackers with all their components such as files, folders and system entries.

Click the following link to download MalwareBytes.

After the download is finished, close all windows on your MAC system. Further, start the saved file. Follow the prompts.

The MalwareBytes Anti-Malware (MBAM) will automatically launch and you can see its main window like the one below.

Next, click the “Scan Now” button to perform a system scan with this tool for the adware related to the VPN Update pop-up scam. This procedure can take some time, so please be patient. During the scan MalwareBytes Anti-Malware (MBAM) will scan for threats exist on your machine.

When MalwareBytes Anti Malware (MBAM) is finished scanning your machine, you’ll be shown the list of all found threats on your MAC system. Make sure to check mark the items that are unsafe and then press the “Quarantine” button.

The MalwareBytes will remove the found adware and PUPs.

Remove VPN Update pop-ups from Safari, Chrome, Firefox

If you’re still getting VPN Update po-ups, then you can try to remove it by uninstalling malicious addons.

Google Chrome	Mozilla Firefox
In the top-right corner, expand the Chrome menu. When the drop-down menu appears, select ‘More tools’ and click on ‘Extensions’. Click ‘Remove’ to uninstall an extension. Click ‘Remove’ in the dialog box. You can also try to remove VPN Update popup scam by reset Google Chrome settings.	Click on ‘menu’ button and select ‘Add-ons’. Go to ‘Extensions’ tab. To uninstall an add-on, click on ‘Remove’ button next to it. If you are still experiencing problems with VPN Update scam removal, you need to reset Mozilla Firefox browser.
Safari
On the top menu select ‘Safari’, then ‘Preferences’. Select ‘Extensions’ tab. Select an extension you want to delete and click ‘Uninstall’ button next to it.

How to stop VPN Update pop-ups

Use an ad blocking tool like AdGuard will protect you from harmful ads and content. Moreover, you can find that the AdGuard have an option to protect your privacy and block phishing and spam web-pages. Additionally, ad blocker apps will allow you to avoid unwanted ads and unverified links that also a good way to stay safe online.

Download AdGuard on your machine from the link below.

Once the download is done, run the downloaded file. The “Setup Wizard” window will show up on the computer screen.

Follow the prompts. AdGuard will then be installed. A window will show up asking you to confirm that you want to see a quick guide. Click “Skip” button to close the window and use the default settings, or click “Get Started” to see an quick tutorial which will allow you get to know AdGuard better.

Each time, when you start your MAC, AdGuard will start automatically and stop unwanted pop-up ads, block VPN Update scam, as well as other harmful or misleading websites.

Finish words

We hope this article helped you learn more about the VPN Update Scam and avoid the scammers. If you have questions or additional information for our readers, please leave a comment.