Cleaner Update pop-up scam (fake) - Free Guide

What is Cleaner Update pop-up scam?

Cleaner Update is an Android-based scam that attempts to make users download questionable software

Cleaner Update is a scam that attempts to trick people into downloading potentially dangerous software

You may encounter a “Cleaner Update” message whenever you browse the web on Chrome or another browser on your Android device. According to a strange pop-up that displays a video in the background that is about to be played, users have to download and install an app from Google Play in order to continue – watch the video in “safe mode.”

In reality, “Cleaner Update” is a browser-based scam that shows up as a pop-up whenever you are redirected to one of the malicious websites that hosts it. For example, we have observed glbltraffic.com spreading the scam. Of course, users do not enter websites like these on purpose but are rather redirected to them, usually whenever they are visiting a compromised website (peer-to-peer^[1] networks, illegal video streaming platforms, etc.)

Alternatively, unexpected browser redirects may indicate that your system has adware installed on it. This software spreads via software bundles^[2] and similar deceptive methods, hence many people don't even know they have it running in the background. We will explain how to deal with the scam after encountering it and how to properly check your system for adware and other infections.

The dangers of software distributed via scam websites

As mentioned, people usually enter the site hosting the Cleaner Update scam by accident, which works very well in favor of scammers. Whenever people are caught off guard, they are more likely to make mistakes and not think things through, which ultimately results in users succumbing to these fake messages.

The scam message could be hosted on a variety of websites, which are usually accessed after clicking a booby-trapped link somewhere else. Here's the message that you might see:

Cleaner Update

Please download the free Cleaner app from Google Play to continue watching in safe mode

Install & Register Now

You should never believe messages which claim that something is missing from your browser or phone and needs to be installed for one reason or another. For example, there are plenty of fake messages spreading online that claim that the system has been infected with various viruses and that security software is missing. By claiming this, crooks make users panic and think that their security and safety are at risk, making them download the software they otherwise would.

Quite often, users are also asked to subscribe for a monthly fee, which would charge the credit card automatically every month or a few weeks. Without users contacting the bank and accessing the online baking, the bills would continue indefinitely. This is just one of the ways of losing money to scams like Cleaner Update.

Those who proceed with the scam and click the required buttons may also be asked to enter their personal information, which can later be sold to the highest bidder on the dark web. Without a doubt, it could seriously compromise one's personal safety and result in further financial losses or even identity fraud.

Random websites display misleading messages, encouraging users to download apps

Finally, the software offered by scam messages is often malicious itself. Even though they often claim that the app is secure and would be downloaded from Google Play or another reputable source, sometimes users are redirected to fake websites created by scammers. As a result, you may infect your device with malware that would steal your personal data, install other viruses or start sending spam.

Check your device for adware and other potentially unwanted applications

First of all, only accessing and seeing the Cleaner Update pop-up scam is not likely to compromise your phone or tablet unless software vulnerabilities^[3] are present on it (this is why it is extremely important to apply all the security updates as soon as they become available).

The most important thing is not interacting with any buttons within the scam page or downloading software via provided links. If you have installed anything, we strongly recommend removing it as soon as possible by following these steps:

1. Go to Settings -> Apps/Applications.
2. Expand the full list of the installed apps.
3. Scroll through the list and tap on a suspicious application once.
4. Tap on it and select Uninstall.
5. Reboot the device.

After the unwanted applications from the device are uninstalled, you should also take care of your cache files, as they could result in further data tracking and the return of advertisements and redirects. You can employ FortectIntego to deal with this issue or perform the steps manually:

1. Go to Settings > Apps/Applications.
2. Expand the full list of the installed apps.
3. Tap on Chrome and select Storage & cache.
4. Clear storage and clear cache of the app.

If you are seeing ads on top of other apps but are not sure what is causing it, perform the following steps:

1. Go to Apps/Applications.
2. Tap Advanced.
3. Select Special App access.
4. Tap on Display over other apps.
5. Eliminate apps with these access rights enabled.

Once you complete these steps, we recommend you perform a full system scan with SpyHunter 5Combo Cleaner or Malwarebytes security software to ensure that your device is not infected with malware that silently runs in the background. Likewise, these security applications can shield you from future malware attacks.

Get rid of push notifications

Sometimes, the cause of unexpected pop-ups is related to the push notification feature. Upon entering a suspicious website, you may be asked to click the “Allow” button within the notification prompt, which would result in intrusive pop-ups showing up at random times. To remediate this problem, block the website that's sending you notifications within browser settings:

1. Open Google Chrome and tap on Settings (three vertical dots).
2. Select Notifications.
3. Scroll down to the Sites section.
4. Locate the unwanted URL and toggle the button to the left (Off setting).