Malware Pop-Ups on Facebook
Scammers use malicious Facebook ads and links that trigger fake virus pop-ups, scaring users into calling fake support or downloading harmful software.
Part of: Malware Popups
Last reviewed: 1 June 2026
Malware pop-ups reach Facebook users through malicious ads and links that, once clicked, redirect the browser to a page that hijacks the screen with an alarming 'virus detected' warning. The trusted, familiar feed lowers suspicion before the redirect strikes.
Facebook is a neutral platform; the harm comes from the malicious landing page behind a deceptive ad or shared link. Scammers exploit the platform's reach and link-sharing to funnel users to scareware pages designed to look like official system alerts.
How this scam works on Facebook
You click an enticing ad, a sensational post, or a shared link, and the browser redirects to a full-screen warning claiming your device is infected. The page may play alarm sounds, block normal navigation, and display a 'support' number.
The pop-up urges you to call the number or download a 'fix', leading to a fake support scammer or to actual malware. The warning is pure web content — it has not scanned anything — but it is staged to look like your operating system or browser raised the alert.
The shock of a locked screen and a blaring warning is engineered to make you call or download before realising it is a webpage.
Common red flags
- Clicking a Facebook ad or link redirects to a 'virus detected' pop-up
- The page tries to block you from closing it or navigating away
- Alarm sounds or flashing warnings accompany the message
- A 'support' phone number is displayed to call urgently
- You are urged to download a tool to remove the supposed threat
- The warning claims to be from your system but appears in the browser
How to protect yourself
- Do not call numbers or download anything from a virus pop-up
- Close the tab or browser; force-quit the browser if the page blocks you
- Know that a webpage cannot scan your device for viruses
- Avoid clicking sensational ads or links in your feed
- Use reputable, self-chosen security software for real scans
- Report the malicious ad or link within Facebook
How to report it
- Use Facebook's 'Report' tool on the ad, post, or link
- Report the scam page to your browser's safe-browsing or phishing service
- File a report with your national fraud or cybercrime reporting centre
Frequently asked questions
How do I close a pop-up that won't let me click away or use the back button?
Try force-quitting the browser entirely through your device's task manager or app switcher rather than trying to close the tab normally, since the page may be scripted to block standard navigation. On most devices this fully removes the pop-up without any lasting effect, since it was only a webpage.
Should I clear my browser history or data after seeing one of these pop-ups?
It's not strictly necessary just from viewing a pop-up, but clearing your browser cache and cookies is a reasonable precaution if concerned, and it can resolve lingering redirect issues. The more important step is making sure you didn't call the number or download anything.
Why did the fake virus warning look like it came from my phone's operating system?
Scammers design these pages to closely mimic the visual style, icons, and sounds of real system alerts specifically to make the warning feel more credible. It remains a webpage running in your browser, not a genuine message from your device — closing the browser removes it entirely.
A virus pop-up appeared after clicking a Facebook link — am I infected?
Almost certainly not. The pop-up is a webpage designed to scare you, not a real scan. Close the tab without calling the number or downloading anything, then run a scan with your own trusted security software if you wish.