Want to highlight a helpful answer? Upvote!

Did someone help you, or did an answer or User Tip resolve your issue? Upvote by selecting the upvote arrow. Your feedback helps others! Learn more about when to upvote >

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Safari-Alert ?scam?

I was browsing Safari on my IMac today when I suddenly got a dialogue box supposedly from Apple Security called Safaro-Alert. It claims suspicious activity detected. Your browser might have been hijacked and then it gives a number to call 1-866-782-9**8 (Not Apple)

Since then I cannot quit Safari on the IMac and when I force quit it returns as soon as I open it.

Anyone else had this experience. Bob (Using my wife's MacBook)


<Personal Information Edited by Host>

iMac (21.5-inch Late 2009), OS X Mavericks (10.9.4)

Posted on Sep 3, 2014 3:29 PM

Reply
100 replies

Mar 18, 2017 4:46 PM in response to marlenefromdenver

I think there are a lot of these out there. I'm seeing multiple different phone numbers they want you to call. I fell victim to one this past summer before I knew what it was. ANYONE WHO READS THIS: THOSE NUMBERS ARE ALL SCAMMERS. THIS ONE WAS CALLED CRESCOLOGIX AND THE NUMBER WAS 1 855 784 7425. If you call it you will hear mexican voices and a lot of people in the background scamming away. They had me write a check and take a picture of it with my computer camera and the money was shortly debited. I haven't had any more trouble with my bank account or anything, so I guess they were just happy to get my money. But my account on my health insurance website is acting very strange now, and almost won't work at all. I took my computer to a mac service store and they wiped my drive and installed avast and it seems ok. NONE OF THOSE POP UP SECURITY ALERTS ARE REAL THEY ARE ALL OF 'EM SCAMS.

Nov 8, 2017 5:45 PM in response to marlenefromdenver

i went to my guest account, downloaded firefox and installed it. went back to administrator and opened an incognito window on firefox and downloaded comodo. updated it and turned my wifi off. scanned and got 15 hits on my bootcamp and then i did the scan again and i finally found one shady one on my mac partition and deleting it solved my problems.

Nov 27, 2017 4:09 PM in response to marlenefromdenver

Don't even read the note it shows. if he tab is titled "ALERT", immediately close it but don't press cancel on the pop-up window. It will say in the pop-up window that you have a trojan virus but it is really the pop-up window itself. You get the virus when you click anywhere on the pop-up. exit the tab and do a quick virus check when you get this tab.

Sep 3, 2014 4:44 PM in response to marlenefromdenver

1. Some of those scam pages can be dismissed very easily. Press command-W to close the tab or window. A huge box will pop up. Press the return key and both the box and the page will close. If that doesn't happen, continue.

2. From the Safari menu bar, select

Safari ▹ Preferences... ▹ Security

and uncheck the box marked Enable JavaScript. Leave the preferences dialog open.

Close the malicious window or tab.

Re-enable JavaScript and close the preferences dialog.

3. If the Preferences menu item is grayed out, quit Safari. Force quit if necessary. Relaunch it by holding down the shift key and clicking its icon in the Dock. From the menu bar, select

Safari Preferences... Privacy Remove All Website Data

to get rid of any cookies or other data left by the server. Open your Downloads folder and delete anything you don't recognize.

Sep 4, 2014 2:37 PM in response to stevejobsfan0123

Yes they accessed my mac and installed CCleaner for Mac form Piriform Ltd. They used Disk Utility>Verify/Repair permissions and then said I had to use the installed app every week to prevent future unauthorized access. Unfortunately the Safari Screnn was grayed out with the message "Safari can't Access the URL..." and was showing the Apple Support phone number which was exactly the same number in the alert, that why I called them.

Sep 4, 2014 2:48 PM in response to Wana1

They may have installed a cracked version of the app. Delete CCleaner and whatever app they used to remotely access your Mac. Most applications can be uninstalled by dragging them from the Applications folder to the trash.


Legitimate companies seldom use pop-ups in this manner, so if you see such a pop-up in the future, research it before calling the number or anything. I would also dispute the $160 charge with your credit card company since these guys are scammers claiming to be Apple.

Sep 4, 2014 2:49 PM in response to Laurent Seroude

Laurent Seroude wrote:


Same issue here but I did not call since it is not a phone# from Apple, do you know the shortcut to disable Javascript (menu are not accessible and there is no shortcut in the develop menu on my MacBook)?

Force quit Safari. Press Command ⌘ + option + esc, select Safari, press Force Quit. While holding the 'shift' key, click the Safari icon in the dock to relaunch it. If this doesn't work, disconnect from the Internet and then relaunch Safari normally. This should prevent the malicious webpage from reloading, and should give you access to the menu bar.


Once the menu bar is accessible again, go to Safari > Preferences, or press Command ⌘ and the , (comma) key. Go to the Advanced tab. Click the check box to enable the Develop menu. Then go to Develop > Disable JavaScript.

Sep 4, 2014 4:58 PM in response to stevejobsfan0123

Thanks SteveJobsfan0123:

I deleted the CCleanner app with my "AppCleanner" application and I also looked for the remote access app they used to "clean" my mac , however I couldn't find it. It looked something like this when they requested to access it :

User uploaded file

I hope it was disconnected when they finished the process, if not is there any way to prevent them to access my mac without my authorization?

Finally I already submitted an stop payment claim to my Bank.

Safari-Alert ?scam?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.