Malware Pop-Ups on Instagram
Scammers use malicious Instagram ads and bio links that redirect to fake virus pop-ups, pressuring users to call fake support or download harmful apps.
Part of: Malware Popups
Last reviewed: 1 June 2026
On Instagram, malware pop-ups arrive through malicious ads, story links, and the clickable links in bios. A tap meant to open a product or article instead redirects the in-app browser to a scareware page warning of an infection.
Instagram is a neutral platform; the danger lies in the malicious destination behind a deceptive link. Scammers exploit story swipe-ups, bio links, and ads to send users to pages staged as urgent system alerts that demand a call or download.
How this scam works on Instagram
You tap an ad, a story link, or a link in a bio, and the in-app browser redirects to a full-screen 'virus detected' warning. The page may block navigation and display a support number or a download prompt.
Calling the number reaches a fake support scammer; downloading the 'fix' installs malware. The alert is web content with no ability to scan your device, but it imitates a system warning to seem authoritative.
The surprise of a locked screen during casual browsing is designed to push an immediate call or install before the user recognises it as a webpage.
Common red flags
- Tapping an Instagram ad or bio link opens a 'virus detected' pop-up
- The page blocks you from closing it or navigating away
- A support number or download prompt is shown urgently
- Alarm sounds or flashing text accompany the warning
- The alert claims to be from your system but appears in the browser
- The link came from an unfamiliar or newly created account
How to protect yourself
- Do not call numbers or download anything from a virus pop-up
- Close the in-app browser tab; force-quit the app if the page blocks you
- Know that a webpage cannot detect viruses on your device
- Be cautious with ads and bio links from unfamiliar accounts
- Use reputable, self-chosen security software for genuine scans
- Report the ad or account within Instagram
How to report it
- Use Instagram's 'Report' option on the ad, account, or link
- Report the scam page to your browser's safe-browsing or phishing service
- File a report with your national fraud or cybercrime reporting centre
Frequently asked questions
I force-quit the app but the pop-up came back when I reopened Instagram — why?
This can happen if the malicious link is still open in a background tab or the app restores your previous session automatically. Fully close the app from your device's app switcher, and if the page reappears, avoid tapping the original link or story again.
Can a malicious link in an Instagram story actually install something without me tapping further?
Simply viewing a story link typically doesn't install anything on its own — the risk comes from tapping to call a number or download a file the page presents. Still, closing the page promptly without further interaction is the safest response if you're unsure.
How do I report the account that posted the malicious ad or story?
Use Instagram's report function on the specific post, story, or ad, selecting the option that best describes the scam or malicious content. This helps the platform investigate the account, which may prevent it reaching other users.
Should I call the number on an Instagram virus pop-up?
No. The number connects to scammers posing as support. The pop-up is a webpage, not a real scan. Close the tab or force-quit the app, and never call or download from such a warning.