Fake “Windows Defender” Pop-ups: Identifying and Removing the Malware

A wave of browser pop-ups claiming “Windows Defender has detected a virus” with a phone number to call — this is not Microsoft, and it’s not a real detection. It’s one of the most common scareware patterns currently circulating, and it relies on a browser permission most people don’t realize they’ve granted. Here’s how to identify it, understand exactly how it’s getting onto your screen, and clean it up properly.

The Complaint

Pop-ups appear even with no browser open at all, styled to look exactly like a genuine Windows security alert — sometimes down to using Microsoft’s own logo and color scheme — urging the user to call a support number immediately or download a “removal tool.” Opening Windows Security directly shows no actual threats detected, no quarantined files, nothing. The alerts kept appearing regardless, sometimes multiple times a day, seemingly at random.

Why This Is Convincing Enough to Fool People

These campaigns work because they exploit a legitimate Windows feature — browser notifications — rather than actually infecting the system with traditional malware in most cases. That’s precisely what makes them so convincing: there’s no suspicious download, no antivirus warning firing, because from the operating system’s point of view, nothing malicious has technically happened. A website has simply been granted permission to show notifications, exactly the same permission a legitimate site like a webmail client or a messaging app might request — and the attacker is using that permission to impersonate Windows itself.

The Evidence

1. The real Windows Defender never asks you to call a phone number. This alone confirms it’s fake — it’s scareware, not a genuine detection. Microsoft’s actual security alerts never include a phone number, ever, under any circumstance.
2. Checking browser notification permissions (Settings → Privacy and Security → Site Settings → Notifications, in Chrome or Edge) revealed a site had been granted notification permission without the user realizing it — most likely from clicking “Allow” on a deceptive prompt while browsing, possibly weeks earlier on an unrelated site.
3. That site was sending the fake alerts as push notifications, which is exactly why they could appear even when no browser tab was open — push notifications work at the operating-system level once permission is granted, independent of whether the browser is actively in use.

The Verdict

Root cause: browser notification permissions were granted to a malicious or compromised site at some point in the past, and that site is now using push notifications to display fake security warnings on an ongoing basis — no traditional malware infection is required for this particular symptom to occur.

Fix, in order:

1. Open your browser’s notification settings and remove any unfamiliar sites from the “Allowed to send notifications” list. In Chrome or Edge: Settings → Privacy and Security → Site Settings → Notifications. Look carefully — the offending entry is often a site you don’t recognize or barely remember visiting.
2. Run a full scan with Windows Security (Settings → Privacy & Security → Windows Security → Virus & threat protection → Scan options → Full scan) to rule out anything else that might have been installed alongside the original deceptive prompt.
3. Run Malwarebytes’ free scanner as a second opinion — it specifically catches adware and PUP-style (Potentially Unwanted Program) infections that Windows Security sometimes misses, and this category of threat is exactly what a scareware campaign like this often travels alongside.
4. Check Task Manager → Startup apps and Task Scheduler for anything unfamiliar that was added recently, and remove it — a scheduled task is a common way for adware to persist even after a scan appears clean.
5. If a “removal tool” was ever downloaded and run from one of these alerts, treat that as a separate, more serious infection and repeat steps 2–4 after removing it specifically — those “tools” are frequently the actual malware, not a fix for one.

Never call the number in one of these pop-ups. The line connects to a scam call center that will attempt to talk you into installing remote-access software, purchasing an unnecessary “support plan,” or both — this is the actual goal of the entire campaign.

What If You Already Called or Gave Remote Access?

If you called the number and gave someone remote access to your PC, or provided any payment information, act immediately rather than just closing the pop-up:

• Disconnect from the internet — unplug the ethernet cable or turn off Wi-Fi — to cut off any active remote session right away.
• Change your important passwords from a different, uncompromised device — banking, email, and anything else sensitive — since a remote session could have exposed saved credentials.
• Contact your bank immediately if any payment or card information was shared, to flag the transaction and watch for further unauthorized charges.
• Run a full scan as described above once you’re confident the remote session has been fully terminated, and consider a clean Windows reinstall if you’re not fully confident the system is clean afterward.

Real Windows Defender Alert vs. Fake — the Tell-Tale Differences

• Location: A genuine Defender alert appears inside the Windows Security app itself, or as a small system notification in the bottom-right corner with the Windows Security icon — never as a full-page browser overlay or a pop-up demanding you can’t easily close.
• Urgency language: Real alerts state what was found and what action was taken (quarantined, removed) in plain, calm language. Fake alerts almost always use countdown timers, flashing warnings, or claims that your data is “being stolen right now.”
• Phone numbers: As covered above, genuine Microsoft alerts never include a phone number. This is the single most reliable tell.
• Audio alarms: Some fake alerts play a loud siren sound automatically — genuine Windows Security never does this.

Other Scareware Variants Worth Recognizing

This same notification-permission technique gets reused with different branding — fake “Apple Security Alert” popups, fake “Your Flash Player is out of date” prompts, and fake “Chrome Update Required” overlays all follow the identical pattern: a deceptive permission request, followed by ongoing fake alerts pushed through that permission. The fix is the same regardless of which brand the scam is impersonating — find and remove the offending site from your browser’s notification permissions.

If you manage a shared or family computer, it’s worth checking notification permissions on every browser installed, and on every user profile — these scams often get through on whichever browser a less security-conscious household member happens to use, and the fake alerts can then appear regardless of which account is actually logged in at the time.

Preventing This From Happening Again

The underlying habit that prevents this entire category of scam is simple but easy to forget in the moment: be deliberate about clicking “Allow” on any browser permission prompt, especially notification requests from sites you don’t recognize or fully trust. Most legitimate sites don’t need notification permission at all, and there’s rarely a real cost to clicking “Block” or simply closing the prompt instead. Periodically reviewing your browser’s notification permission list — the same page used in the fix above — every month or two is a cheap habit that catches this before it becomes an ongoing annoyance.