Tell-tale signs
- Full-screen browser warning that you cannot close, often with an alarm sound
- A phone number to call Apple Support or AppleCare — Apple never displays a number on a web page like this
- Claims your Mac is infected with viruses (a web page cannot scan your Mac)
- Asks you to open Terminal or Script Editor and paste a command (this is the ClickFix attack — see warning below)
- Pretends to be from McAfee, Norton or AppleCare and demands you renew immediately
Important
Never paste a command into Terminal or Script Editor that came from a website. The most common 2024 Mac infostealer (Atomic Stealer) is delivered exactly this way.
How to safely close it
- Do not call any phone number on screen
- Press ⌘ Q to quit Safari/Chrome (or ⌘ ⌥ Esc → Force Quit)
- Reopen the browser while holding Shift to skip restoring tabs
- Clear browsing history for the last hour: Safari → History → Clear History
Tags:
Phishing & Scams
Was this guide helpful?
Know someone who needs this? Send them the guide.
JD
Written by
Jordan DicksonFounder, CyberSecurityGuides
Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.
Reviewed by CSG Security Engineers