Calendar virus (spam) - May 2021 update

What is Calendar virus?

Calendar virus is the deceptive campaign that creates redirects to various sites filled with possibly malicious material

Shady events are nothing more but a scam, so you should avoid clicking on promoted links

Calendar virus is an iPhone-related scam that helps to trick mobile users into clicking on ad-like events, usually named “Click Subscribe.” This is the infection that doesn't appear as a program on the machine. It leads to various redirects and shows dubious sites in applications, injects events and random links where they are not supposed to appear. It's a non-typical member of the iPhone virus family as this particular scheme has been programmed to target the Calendar app by filling it with fake event links, which keep displaying reminders when the scheduled time comes up. Nonetheless, the same activity can be found on Macs^[1] or other platforms as well.

Each notification contains a link and a short description, such as “Kate send you 5 pictures” or “It's your lucky day.” However, there's no option to disable these notifications easily, and that's the main reason this type of issue is particularly disruptive and annoying to users.

These questionable entries appear seemingly out of nowhere. The spam may invite people to participate in various deals, sales, register to the dating portals, claiming prizes, etc. Often people fall for clicking on suchlike ads as they are displayed within the legitimate app, which makes them seem more trustworthy (it is not the case, however).

In most cases, users believe that the spam activity is related to malware, although it is not likely to be the case. In most cases, deceptive techniques (phishing email, fake alerts on suspicious sites, etc.) are used to add an entry on iPhone or Android or a malicious profile into these devices. Thus, the only way to get rid of these persistent scam messages is by deleting these entries.

Remember, URLs like notice-iphone.club or alert-booster.club should never be trusted. You can find a guide below that shows how to reset browsers, eliminate unwanted notifications and clear the machine fully from any threats like this, so you can avoid any damage and remove the virus.

The suspicious activity may appear on many devices, including Windows/macOS desktop machines, as well as iPhone and Android phones. Users say^[2] that they have been infected with the iPhone Calendar virus and question the security of their devices because such alerts may seem either dangerous or related to malware.

Variations of the scam include messages like You Have Won iPhone X Max from AppleStore or Your iPhone Xs Max is ready for PickUp that comes from various websites, including:

In fact, the list of domains that can cause these changes in the app is endless. New related variants appear each day, so it's important to check what is happening on your device every day. Anything that happens on your device without permission should be taken seriously, although many would like to remove Calendar virus just because of its intrusive nature.

This phenomenon is (usually) an Apple device-targeting campaign that focuses on deceptive advertisements and pushes notifications that trigger clicks and permissions so that events can be added to the applications. When people start seeing these entries and other intrusive content, it becomes a difficult process trying to decline, delete them or close additional pop-ups and notifications that appear after a redirect or click on the provided hyperlink.

The event is automatically added, and once the date arrives, you get a notification about it. iCloud applications and other apps can automatically notify you about every notification, and spammers misuse this feature for their advantage. Pop-up notifications come to your screen repeatedly, tricking you into clicking on them and visiting sites or confirming something. You shouldn't fall for the scam, as if you click on the links and insert your personal information, you may infect your device with malicious software or suffer significant monetary losses.

Interacting with spam can lead to many scenarios. The worst of them could be phishing site redirects,^[3] techniques triggering sensitive data collection, or info-stealing malware. If you got exposed to any material regarding advertising pages, software promotions, and other misleading content, try to delete the Calendar virus by exiting those web browser windows and checking the system for malware traces.

Calendar virus is the scam campaign that makes fake entries with deceptive claims about iPhones you won or possible malware risks to attract your attention

Unfortunately, there is no particular solution for the issue, and there are many versions of the same notifications virus. You cannot mark those invites as spam in most cases, but invites can be declined. You can get fraudulent spam events by responding to a scam email, too, regardless if you press Allow or Block.

Pop-up notifications redirect to shady or malicious sites, which might trick many. Then you are left with a hard question and a few methods for virus removal. Since the intrusion managed to change calendar preferences, it can also attempt to change the settings of your machine, add files, programs, or disable some features. You need to consider that and make sure to prevent all potential risks of getting these intrusive symptoms repeated.

If you clicked on links via these notifications and downloaded something, there is a chance that your system is infected, and you need to perform malware elimination ASAP. The best way to do it is by scanning the device with SpyHunter 5Combo Cleaner, Malwarebytes, or another reputable security software.

Some malware, such as info-stealing Trojans, employ techniques that can be used to collect information about your online activities by recording keystrokes or other methods and then sending this data directly to cybercriminals. Thus, do not wait and ensure that your system is cleaned.

Redirects to suspicious websites might result in financial losses or personal data exposure

Crooks use attractive but fake headlines

Multiple domains could be used to deliver suspicious notifications directly to users' screens. These persistent messages use social engineering in order to make users click on the link and then proceed with whatever crooks intended them to.

Regard0less of techniques, all of the scam authors seek only one goal, which is money – be it valuable personal information that could be sold for marketing purposes, installation of unwanted programs that third parties get a commission on, or user exposure to intrusive ads.

Clicking on iPhone ads poses a risk to your device security because the provided hyperlinks may be linked to rogue pornographic websites, fake software download sites, or rogue survey domains. Therefore, even though some slogans positioned among Calendar events seem appealing, do not fall for clicking on them. The most common spam ads are:

• Try Apple news + free
• Clear Your iPhone from Malicious Attacks
• Protect Your iPhone from Possible Malicious Attacks
• Free your iPhone from Threats
• Get Apple News for FREE
• Your iPhone may be exposed to 4 viruses
• Click now to secure your iPhone
• You are exposed online, click to fix
• Virus alert – check protection now
• (1) Congratulations – you won!
• It's your lucky day
• You have (1) pending package
• iPhoneXs is ready, pick it up, or choose delivery!
• iPhone security pack discount
• Hackers might try to take control over your iPhone! CLICK NOW to stay protected.

The more widespread versions

Notice-iphone.club

Notice-iphone.club is one of the most active addresses that are used to deliver event spam to victims. In most of the cases, users visit websites of poor reputation that provide some type of useful functionality, such as TV show streaming, online gaming, porn videos, etc. These sites are usually filled with intrusive ads that may pop up seemingly out of nowhere, just at the time when users tap on their screens. As a result, they start seeing notifications from Notice-iphone.club.

The prompts from Notice-iphone.club are geo-location-based so that users might see phishing messages in their native language – this is very typical to ad content. Typically, the content of notifications includes messages from an alleged secret lover, threatening messages that claim phone vulnerability,^[4] claims about malware infections, etc., so users may see entries like “Kate sent you (5) pictures,” “You are exposed online,” “Clear your iPhone from malicious attacks!, “Viruses alert – check protection NOW,” etc. As evident, you should remove Notice-iphone.club pop-ups instead of clicking on links inside these scam notifications.

Alert-booster.club

Alert-booster.club is another domain that infiltrates iPhones with intrusive spam. Just as with other similar scams, intrusion happens either when users accept a calendar invitation via a phishing email or when they accidentally click on a link steaming from a malicious website.

Once the new entry is established, users start receiving Alert-booster.club pop-ups via their phones of various content. In most cases, threat actors behind this scam use fake messages in order to intimidate users and make them download unknown applications, provide personal information by registering to some allegedly useful service, or visit websites of dubious content.

In any case, you should not click on Alert-booster.club pop-up messages that read:

• Viruses on your iPhone?! CLEAN THEM NOW
• Ensure Your Online Protection, Click Now!
• Who wants a Free Apple Music Subscription?
• Your Phone is not Protected! Click to protect, etc.

Typically, crooks use domains like Alert-booster.club and Notice-iphone.club to deliver intrusive pop-ups to users

Notices-cleaner.best

Notices Cleaner Best is yet another iPhone scam, which may be triggered either by a potentially unwanted program (PUP) on the device or a malicious website that has added events without the user's permission. Also known as notices-cleaner.best, the scam may be used for spreading malware or data extortion campaigns. Notices Cleaner Best scam typically creates a scheduled event saying:

iPhoneXs is ready, pick it up, or choose delivery!

Clicking on the link provided below the notification redirects to a questionable website, which clarifies a supposed reason why you've been selected to participate in a lottery and then asks to fill in the form indicating your name, address, telephone number, and similar information. No matter how seductive Notices Cleaner Best ads may seem, do not submit the required information as you may unconsciously subscribe to useless service or, even worse, get scammed.

Since there is no antivirus software for Macs, experts recommend checking Safari, Google Chrome, or another web browser for unfamiliar add-ons and disabling them. Besides, you can prevent malicious events from being added to the Calendar app by changing Event settings. A full explanation of how to do that is given below.

Mobile Apple devices are actively spammed via an app, which generates fake scheduled events due to malware

Notices-booster.best

Previously referred to as a notices-booster.best virus, the relaunched spam campaign displays misleading event alerts named Notices Booser Best, which congrats a potential victim for being a winner of an annual competition and demands to follow the instructions to claim the $1541 worth reward.

Notification №6538 CONGRATULATIONS!
Your e-mail address is the winner of our annual competition! Your prize money is $1541. Follow the instructions on the website to get it (URL address)

If criminals receive permission to add an event to the Calendar app, the intrusive prize giveaways and other hard-to-believe offers start coming out straight from the legitimate app on the iPhone or another device.

Some of the virus versions trigger redirects to fake websites of a supposed International E-mail Associations

Protection-fix.fun

Protection-fix.fun is a site that shows warnings and pop-up alerts about malware issues or security problems that, in most cases, are not related to the infected machine at all. The domain shows a message stating that the iPhone or iPad is not protected.

Of course, the message that shows up in the calendar application is a pop-up and triggers a particular site to open. On the page, users are typically shown a fake alert about their device protection status. These claims are false and created to trick people into allowing other site appearances and redirects to shady sites that can promote tools and deliver dangerous or even malicious programs.

Notice-booster.site

Yet another site with deceptive purposes – Notice-booster.site offers to help with virus issues that randomly got detected by the suspicious program. Events on the Calendar application encourage people to allow the program on the system or even purchase the rogue security/ “antivirus” tool. This site can also show commercial content besides those misleading messages, so people risk getting their personal information revealed to third-party or malicious actors.

Your web browsing application gets significantly affected when the particular intruder gets on the device. This type of program can create huge issues and even though it doesn't seem like a big deal, PUPs can damage crucial functions of the computer operating system. The site should be ignored and every redirect avoided. Clicking on any pop-up ad or banner can cause more problems.

Unwanted entries can show various phishing and scam messages continuously

Notice-device.club

Notice-device.club site appears in the event message claiming that Your device is vulnerable to online threats, cyber malware, and can get damaged when the user is not taking any actions. Apple devices that this alert shows upon, in most cases, have no particular issues.

These false alerts all focus on deceptiveness, so the user can be misled to the sponsored page, third-party service, and exposed to possibly dangerous content. Even though these themselves are not malicious, sites that lead to download pages and other rogue domains can trigger malware installations directly on the machine.

Make sure to clear the system properly with tools like SpyHunter 5Combo Cleaner or Malwarebytes, so none of those Calendar virus versions can find the way to serious OS settings and leave virus damage on the machine. If that still happens and the machine gets damaged, rely on FortectIntego that should find and fix particular parts of the system that need optimization.

Biogrammad.club

Biogrammad is another Apple iOS devices targeting scam campaign that involves interference with applications on mobile devices. It can appear on iPads, iPhones, iPods even. The message that is related to this particular domain states about not protected iPhone and issues regarding malware, cyber infections, or even hardware issues.

It comes on the screen out of nowhere and triggers those entries, so people get messages, alerts about the event that is a scam message instead. These social engineering tactics aim to get users' attention, cause clicks, and page visits on sponsored pages. The particular Biogrammad.club also spreads around by using free application promotions, installations, and shady distributor content.

Moneymsg.com

This browser-based threat appears on various mobile devices and stops the activity with urgent messages that state vulnerabilities, malware issues, and other false claims. This pop-up generates ads and links users to the moneymsg.com site and other shady domains that show nothing but false information or simply redirect to malvertising sites.

You can notice the pop-up on Safari, Chrome browsers, and in your built-in applications. The browsing experience quickly is diminished when the pop-up windows start appearing out of nowhere.

Find and remove any suspicious programs from the Android device

1. Locate Settings on your device.
2. Go to Apps/Applications.
3. Expand the list of installed apps.
4. Scroll to find any suspicious applications.
5. Tap on it and select Uninstall.
6. Reboot the device.

Clear Storage and data files from Google Chrome or other apps:

1. Go to Settings > Apps/Applications.
2. Expand the list of apps.
3. Tap on Chrome and choose Storage & cache.
4. Hit Clear storage and clear cache of the app.

If you see ads on top of other application content out of nowhere, control the display preferences:

1. Go to Apps/Applications.
2. Tap Advanced.
3. Choose Special App access.
4. Hit Display over other apps.
5. Eliminate apps with these access rights enabled.

Scammers improve their methods and make their schemes more tricky than ever

Junk email notifications include invitations or additional pop-ups with Accept or Decline buttons. Unfortunately, no matter which button you click they all trigger the same function. In some cases, such deceptive material leads to other push notification redirects, or you encounter direct pop-ups on the desktop from there, install the PUP, or a virus without noticing.

Experts^[5] note that this interaction may also be needed for a scammer to make sure that your email address is active and can be targeted more with scammy messages and malware-laced content. You should simply delete the received email that raises questions or is suspicious due to content or the initial sender. This is probably the best way to avoid spam campaigns and exposure to these shady services and online material.

Also, those redirects, sites with false messages about malware infections, other risks, lotteries, prizes, and so on are symptoms of the potentially unwanted program or the adware-type intruder. This application is the one that triggers redirects and the constant appearance of shady websites with questionable content.

PUPs spread around during freeware installations when the person who downloads wanted software chooses recommended or quick options and automatically allows all the intruders to come on the device. You need to choose Advanced or Custom installations and, more importantly, rely on official developers and application providers to avoid this pre-bundling in the first place.

Calendar virus removal options

Since the virus is a threat affecting various parts of the device it can get pretty dangerous over time. You should clean the machine and eliminate the potentially unwanted program that triggered those unwanted popups or can lead to additional issues with the system. There are tons of domains that trigger redirects to sponsored or affiliated pages and make these spam campaigns happen.

You should go to the Calendar application and tap Calendars at the bottom. You should locate all the suspicious entries and tap the i in the circle to get more information and options. Scroll to the bottom, so you can press Delete Calendar. After that, you may need to block pop-ups on your browsers and clean, additionally installed extensions or tools. To do so, follow the removal guide below.

TIP: to prevent the spam from reappearing, please follow these steps:

1. Open your web browser and sign in to your iCloud account.
2. Open the Calendar section.
3. Click on the gear icon on the bottom-left corner of the screen.
4. Select Preferences and then navigate to the Advanced tab.
5. Find the Invitations section and select Email to [email address].
6. Click Save to finish.

You may remove virus damage with a help of FortectIntego. SpyHunter 5Combo Cleaner and Malwarebytes are recommended to detect potentially unwanted programs and viruses with all their files and registry entries that are related to them.