'McAfee - Act Now To Keep Your Computer Protected' Pop-Up Scam

popups adware

There is yet another scam making the rounds, once again abusing the name of a legitimate piece of PC security software for illegal profit. This scam is referred to simply as the "McAfee - Act Now To Keep Your Computer Protected" scam.

First things first, it should be noted that the web pages and domain names associated with the scam are not related or connected to McAfee Corp and are simply abusing the brand and imagery of McAfee to lure people into clicking a malicious link.

There is at least one known domain associated with the scam, at "ladybugprotection dot store". The page hosted on it shows what looks like relatively a relatively high-effort attempt to spoof official McAfee branding and promotional materials. The page claims you can "act now" to protect your system and offers a fake 60% discount.

Clicking the "Protect now" button on the scam's page results in a redirect to clickrtraq dot com, along with the warning "Your connection is not private

Attackers might be trying to steal your information from clickrtraq.com (for example, passwords, messages, or credit cards). NET::ERR_CERT_AUTHORITY_INVALID".

If you disregard that and attempt to continue despite the security warning, you are stuck in an endless refresh loop on what looks like a blank page at clickrtraq dot click, forward slash click, along with an ERR_HTTP2_PROTOCOL_ERROR error.

When you run into similar fake and fraudulent pages online, always make sure to double-check the domain name in the address bar and steer clear of any weird or suspicious names you don't recognize.

June 24, 2022