Kafos.xyz: what it is and how to remove it
This site then exploits this apparent threat to manipulate users into procuring its supposed antivirus software. Please be advised that these virus infection alerts are entirely fraudulent and merely mimic the appearance of an authentic security scan.
Facts checked October 7, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
A scan of the PC is a quick way to confirm nothing was installed alongside the "Scan results: 2023_TROJAN virus, password_SPY, AdSwitcher detected" pop-up.
Do it yourself · free Remove Kafos.xyz yourself 3 steps, about 9 minutes, no software needed.
Kafos.xyz: summary
| Distribution | Redirects from other malicious websites, adware |
|---|---|
| Damage | Loss of finances due to fake subscriptions; redirects to other malware-laden, scam websites; installation of potentially unwanted or malicious software |
| Name | Kafos.xyz |
| Type | Scam, phishing, redirect, adware |
| Operation | Shows a pop-up that claims that trojans and other malware have been detected, then prompts users to purchase software to remove the allegedly found threats |
| Detection names | No Microsoft detection name is known |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 5 more facts
| Symptoms | A fake virus warning in a browser tab |
|---|---|
| Evidence | One write-up by a security site; details still limited |
| Domains | kafos[.]xyz |
| First seen | 28 June 2023 |
| Facts checked | 7 October 2026 |
What the Kafos.xyz pop-up looks like
Scan results: 2023_TROJAN virus, password_SPY, AdSwitcher detected
It is highly recommended to use an antivirus immediately!
Is the Kafos.xyz warning real?
- Address:
kafos[.]xyz
From our report of Jun 2023 · not reviewed since
More from our earlier report on Kafos.xyz
- Kafos.xyz is an illicit website engaged in a deceptive tactic that simulates virus infection alerts, purportedly from notable cybersecurity solutions such as McAfee.
- Check your system with security software to ensure no adware or malware is running in the background
- Upon successful eradication of adware and other potentially unwanted programs, it is recommended to clear your browser of cookies and other tracking elements.
- The tool can be instrumental in facilitating this cleansing process.
- Scan results: 2023_TROJAN virus, password_SPY, AdSwitcher detected Trojan found on this PC will most likely copy and delete all data from hard drives.
- Spyware will attempt to collect logins, passwords, and banking details.
- Adware usually replaces search results with false and scammy websites.
- Trojan found on this PC will most likely copy and delete all data from hard drives.
What the Kafos.xyz scammers want
From our report of Jun 2023 · not reviewed since
Kafos.xyz is a fake website that tries to intimidate users while showing fake virus infection alerts
This site then exploits this apparent threat to manipulate users into procuring its supposed antivirus software.
Please be advised that these virus infection alerts are entirely fraudulent and merely mimic the appearance of an authentic security scan.
While the virus scans administered by Kafos.xyz lack credibility, the potential existence of adware on your system should not be overlooked. Adware, often responsible for generating such spurious alerts, may subject your system to diverse cybersecurity risks if not addressed promptly.
In subsequent sections of this article, we will dissect the intricacies of the Kafos.xyz scam and offer comprehensive instructions on detecting and eradicating potential adware on your device. Ensuring a robust understanding and awareness of these issues is essential in safeguarding your digital domain from such exploitative practices.
From our report of Jun 2023 · not reviewed since
How the scam works
Online fraud is a scourge of the digital age.
With the advent of the internet, scammers have found new ways to exploit unsuspecting individuals in their quest for easy profits. These cyber criminals craft deceptive schemes that tap into our fears, our trust, and our ignorance of digital threats. Their strategies are constantly evolving, keeping pace with the advances in technology and exploiting the vulnerabilities in our increasingly digital lives.
Often, users stumble upon these dubious sites accidentally, and the surprise factor could catch them off guard. The sophisticated design and seemingly professional tone of the website can lull individuals into a false sense of security. A typical experience might involve encountering an alarming pop-up message such as the following:
Crooks use this sort of message as a tool of social engineering, leveraging fear and urgency to manipulate user behavior. The language is purposefully alarming, designed to incite immediate action. The specificity of the threats listed - a Trojan that could wipe your data, spyware poised to steal sensitive information, and adware skewing search results - adds a sense of legitimacy and heightens the perceived urgency.
By convincing users that their system is under immediate threat, these fraudsters aim to drive them into buying the "antivirus software" they conveniently offer. However, this software is often non-functional or worse, may even contain malware. This scam exploits the user's fear and trusts in what seems like a solution, a classic example of problem-reaction-solution manipulation.
In reality, the only threat users face comes from the scammers themselves. The infections listed are fictitious, and the real danger is the potential loss of money and the risk of further compromise of their computer system.
How to get rid of the Kafos.xyz pop-up
The warning is a web page and your PC is not infected by it.
Close it, then remove what keeps bringing it back.
Which browser shows the ads?
Step 1: Remove kafos[.]xyz from Chrome's notification list
Chrome keeps a list of every site you once allowed to send notifications, and
kafos[.]xyzis on it. Pastechrome://settings/content/notificationsinto the address bar, find kafos[.]xyz under Allowed to send notifications, open the three-dot menu next to it and pick Remove.Then click Add next to Not allowed to send notifications and type kafos[.]xyz, so the site cannot ask a second time. Repeat it in every Chrome profile you use on Windows 11 or Windows 10, since each profile has its own list.
Chrome on Windows 11: Settings > Privacy and security > Site settings > Notifications. Full procedure with screenshots: Stop website notifications and pop-ups
Step 1: Remove kafos[.]xyz from Edge's notification list
Open Settings and more (the three dots) > Settings > Privacy, search, and services > Site permissions > All permissions > Notifications. Remove
kafos[.]xyzfrom the Allowed list, then click Add site next to Not allowed to send notifications and enter it there.Edge is built into both Windows 11 and Windows 10, so check it even if you normally use another browser. If the notifications came with the Edge logo, this is the browser that holds the permission.
Edge on Windows 11: Site permissions > All permissions > Notifications. Full procedure with screenshots: Stop website notifications and pop-ups
Step 1: Remove kafos[.]xyz from Firefox's notification permissions
Open the menu (three lines) > Settings and click Permissions and data in the left list, then Notifications. Select
kafos[.]xyz, click Remove Website and confirm with Save Changes.In versions older than Firefox 152 the same list sits under Privacy & Security, behind a Settings button next to Notifications. Firefox shows these notifications only while it is running, on Windows 11 and Windows 10 alike.
Firefox on Windows 11: the Notification Permissions window. Full procedure with screenshots: Stop website notifications and pop-ups
Then, whichever browser you use
Step 2: Close the page without touching its buttons
Press Ctrl + Shift + Esc to open Task Manager, select the browser on Processes and click End task: buttons on the page, including Close and Cancel, can trigger downloads or more pop-ups. When you reopen the browser, do not restore the previous tabs.
Warning: Never call a number shown in a browser warning; Microsoft and antivirus companies do not put phone numbers in warnings.
If the page opens again by itself, notifications or an extension are bringing it back. Task Manager works the same in Windows 11 and Windows 10.
Full procedure with screenshots: Close a frozen app (Task Manager, Force Quit) On uGetFix
Step 3: Scan the PC, then run the offline scan
A scan finds the parts of Kafos.xyz that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options, start a Full scan and quarantine what it reports.
Follow it with Microsoft Defender Antivirus (offline scan) > Scan now, which restarts the PC and checks the disk while Windows and the malware are not running.
It takes about 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
More removal instructions
For programs installed on the PC and older browsers. Open the one you need.
Tips to avoid being scammed online
Avoiding online scams and inadvertently installing potentially unwanted programs (PUPs) requires an understanding of digital threats, vigilant practices, and proactive security measures.
To enhance your online safety, consider the following guidelines:
By adhering to these best practices, users can significantly decrease their chances of falling prey to online scams or inadvertently installing PUPs. As with many aspects of online life, awareness, and caution are key to maintaining security.
- Understand the landscape. Reputable organizations, including antivirus companies, do not use pop-up ads or unsolicited emails to request personal information or to alert you about potential threats. Treat unexpected alerts with skepticism.
- Practice safe browsing. Refrain from clicking on suspicious links, pop-up ads, or banners, as these can lead to fraudulent websites or prompt downloads of PUPs.
- Update regularly. Ensure your software, operating system, browser, and security software are up to date. Many updates include patches for security vulnerabilities that could be exploited by fraudsters.
- Invest in security. Install and maintain reputable antivirus software. Many of these programs offer real-time scanning capabilities that can detect and neutralize PUPs before they cause harm.
- Download wisely. Avoid downloading software from untrusted or unofficial sources, which may bundle PUPs with the intended software. Opt for downloads from official websites or trusted platforms.
- Be selective during installation. Use the "custom" or "advanced" installation options to deselect any bundled software that you don't need or want.
Adware removal explained
In the aftermath of encountering potentially harmful websites such as Kafos.xyz, it's imperative to ensure your system is free from adware.
To do this, perform a comprehensive system scan using reputable security software such as or . These tools are designed to identify and remove all adware-related components in a swift and straightforward manner, making them a practical option for users.
Although manual removal of unwanted programs is a viable alternative, it may prove complex and time-consuming. Moreover, inadvertently removing necessary programs can lead to further complications. Hence, an automated removal approach facilitated by trusted security software is usually the most efficient and risk-free choice.
Once the device has been thoroughly scanned and any detected malware or adware has been eradicated, the next important step is to cleanse your browser of cookies and other tracking elements.
For this purpose, tools like can be employed, or users can opt to perform this task manually by following the below instructions. Ensuring the removal of these trackers will further reinforce your system's security and reduce the likelihood of future intrusions.
MS Edge (Chromium)
One notable feature of the Kafos.xyz scheme is the request to enable push notifications. Users should exercise caution as consenting to these notifications opens another avenue for the site to continue its deceptive practices. These push notifications can be used to display additional fake alerts, further creating a sense of imminent threat and urgency.
Moreover, they can bombard users with unwanted advertisements and even potentially direct them to other malicious websites. Therefore, if you have enabled push notifications from this site, it is important you block it, as explained below.
- Click on Menu and pick Settings.
- Under Privacy and security, select Clear browsing data.
- Select Browsing history, Cookies and other site data, as well as Cached images and files.
- Click Clear data.
- Click Menu and pick Options.
- Go to Privacy & Security section.
- Click on Clear Data...
- Select Cookies and Site Data, as well as Cached Web Content, and press Clear.
- Click on Menu and go to Settings.
- Select Privacy and services.
- Under Clear browsing data, pick Choose what to clear.
- Under Time range, pick All time.
- Select Clear now.
- Click Safari > Clear History...
- From the drop-down menu under Clear, pick all history.
- Confirm with Clear History.
Stop browser notifications
Stream videos without limitations, no matter where you are
There are multiple parties that could find out almost anything about you by checking your online activity.
While this is highly unlikely, advertisers and tech companies are constantly tracking you online. The first step to privacy should be a secure browser that focuses on tracker reduction to a minimum.
Even if you employ a secure browser, you will not be able to access websites that are restricted due to local government laws or other reasons. In other words, you may not be able to stream Disney+ or US-based Netflix in some countries. To bypass these restrictions, you can employ a powerful VPN, which provides dedicated servers for torrenting and streaming, not slowing you down in the process.
Data backups are important - recover your lost files
Ransomware is one of the biggest threats to personal data.
Once it is executed on a machine, it launches a sophisticated encryption algorithm that locks all your files, although it does not destroy them. The most common misconception is that anti-malware software can return files to their previous states. This is not true, however, and data remains locked after the malicious payload is deleted.
While regular data backups are the only secure method to recover your files after a ransomware attack, tools such as can also be effective and restore at least some of your lost data.
Questions about Kafos.xyz
Did the "Scan results: 2023_TROJAN virus, password_SPY, AdSwitcher detected" pop-up really find a virus?
It did not find anything, because a web page has no way to look at your files. The scan animation, the number of threats and the warning "Scan results: 2023_TROJAN virus, password_SPY, AdSwitcher detected" are part of the page and are the same for everyone who lands on it.
What the pop-up does tell you is that your browser was sent to a scam page, either through an ad, a redirect or a notification permission. That source is worth removing.
For a real answer about infections, run a scan in Windows Security or another antivirus you installed yourself, not one offered by the page. If the real scan finds nothing and the page stops after you clean up notifications and extensions, you are done.
The "Scan results: 2023_TROJAN virus, password_SPY, AdSwitcher detected" page made me install something. What now?
Uninstall it first. Open Settings > Apps > Installed apps, sort the list by install date and remove whatever appeared when the page showing "Scan results:
- 2023_TROJAN virus
- password_SPY
- AdSwitcher detected" told you to install it
Check the browser's extensions as well, since some pages push an extension instead of a program. Then run a full scan with Microsoft Defender, and an offline scan if anything is found.
If the program was a remote-access tool, or if you typed passwords while it was installed, change those passwords from another device and turn on two-step verification. Keep the file name and the page address; they are useful if you report the scam.
Why does my browser keep opening kafos[.]xyz?
Because something sends you there. The usual causes are a notification permission you gave to some site, an adware extension, or a site you visit often that shows redirect ads. The site itself cannot open on its own.
Remove unknown sites from the notification settings, check the extensions list, and do not restore the previous session when the browser starts. If the page appears even with the browser closed, look in Installed apps for programs you did not install. Running a scan with Windows Security afterwards confirms that nothing else is involved.
Do I need to reset my router because of Kafos.xyz?
No. Fake alert pages work inside the browser and do not change router settings. The sign reported is A browser warning that reads "Scan results: 2023_TROJAN virus, password_SPY, AdSwitcher detected", which comes from a web page, not from the network. Resetting the router will not stop it.
What stops it is removing the browser permission, extension or program that opens the page. If you see the same page on every device in the house without visiting the same sites, that is unusual and worth checking the router's DNS settings, but it is not what has been reported here.
Will Kafos.xyz come back after I close it?
It may, if the thing that opened it is still there. Closing the tab ends that one page, but a notification permission, an extension or an adware program can open A browser warning that reads "Scan results:
- 2023_TROJAN virus
- password_SPY
- AdSwitcher detected" again later
Check the browser's notification settings and extensions first, then Installed apps for anything new. If the page does not return within a day or two of normal browsing, you have removed the source. If it does, reset the browser, which clears permissions and settings in one step.
The page will not close. What can I do?
Press Esc to leave full-screen mode, then close the tab. If the browser is frozen, open Task Manager with Ctrl + Shift + Esc, select the browser and click End task. When you restart the browser, do not restore tabs.
If the page loads again on start, open a new window and close the old one, then remove the page from the browser's startup settings. Restarting the PC also works. Nothing was installed by the page, so closing it by force is safe and loses nothing.
The agent knew details about my PC. Were they real?
They looked real but proved nothing. Callers from pages like Kafos.xyz open the Windows Event Viewer, which shows harmless warnings on every PC, or run a command that lists normal system details, and present them as signs of infection. Some type alarming text into a command window themselves.
Nothing they showed you came from a real scan. If they had remote access, follow the clean-up steps anyway, because they may have installed tools while you watched. Change any password they could have seen.
Which browser settings protect against fake alerts?
Three matter most. First, notifications: set your browser to ask before allowing them, and block sites you do not trust. Second, reputation checks: SmartScreen in Edge and Safe Browsing in Chrome warn you before known scam pages load, and Firefox has its own deceptive-content protection under Privacy & Security.
Third, pop-ups and redirects: keep the default blocking on. Add a reputable ad blocker if fake alerts keep reaching you through ads on sites you use. Review the notification list every few months.
Can Kafos.xyz harm my PC just by being open?
No. A web page runs inside the browser's sandbox and cannot install programs, read your files or change Windows settings on its own. Kafos.xyz can only make noise, fill the screen and try to persuade you. The risk begins when you follow it:
- calling the number
- paying
- downloading a file
- pasting a command
Close the page, and if it frightened you into doing one of those, follow the matching steps in this guide. Otherwise, nothing on the PC needs cleaning or repairing.
Will Fortect remove Kafos.xyz?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Kafos.xyz, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- FTC: How to spot, avoid and report tech support scams (read October 7, 2026)
- FTC: How to recognize, remove and avoid malware (read October 7, 2026)
- Microsoft Learn: Microsoft Defender Offline (read October 7, 2026)
- Microsoft Learn: How Microsoft names malware (read October 7, 2026)