Mac Detected TAPSNAKE infection pop-up: a scam, not a virus

It is a fake tech support warning, not a message from your Mac. A website opens a dialog headed with its own address that says an infection called TAPSNAKE was found, tells you not to restart, and asks you to call a toll-free number and quote a code.

Apple says pop-ups that warn about viruses are usually fraudulent advertisements, and the FTC says real security warnings never ask you to call a number. The page cannot scan your Mac. Closing the tab ends it.

We found no source for a program called TAPSNAKE, so we treat the name as part of the script. Our 2017 guide called it a Tech Support scam virus and an adware, and adware or an unwanted extension can reopen such pages again and again.

But the dialog itself is just a web page that a redirect from an ad can open with nothing installed. If it appeared once, you most likely have nothing to remove. If it returns on unrelated sites, check Safari's extensions, notifications and your login items.

Not by the page alone: a website cannot scan your drive, which is why every visitor sees the same message. Apple says unwanted software can become intrusive and can even damage your Mac, so look at your extensions, login items and recently added apps if the dialog keeps coming back.

If you called the number, installed something they asked for or let them connect, treat the Mac as exposed: follow the steps for a call above and change your passwords from another device.

No. The FTC says real security pop-up warnings never ask you to call a phone number, and legitimate tech companies do not contact you to say there is a problem with your computer.

Apple tells you to hang up on unexpected calls claiming to be from Apple support and to use its official channels. The number is the point of the page:

• the scammers want to sell a fix
• collect gift cards
• connect to your Mac

The numbers we recorded, 800-130-1949 and +64-800-003-313, are listed above only so you can recognize them.

Nothing bad. The warning about data loss and a Mac that will not boot is a lie meant to keep you on the page, as our 2017 guide said. Apple's advice for such pop-ups is to ignore the message and navigate away or close the window or tab.

Quit the browser with Command+Q, or force quit it with Option+Command+Esc if it does not respond. If Safari offers to restore the last session, say no, or hold Shift while opening it so it does not reopen the old tabs.

We found no source that explains it. In our picture the dialog asks you to give it to the "technician". It most likely works as a made-up ticket number that makes the call feel official, and it can differ from page to page.

Do not read it to anyone. Apple says it never asks for your password, device passcode or verification code. If you already gave out a code or a password, change your Apple Account password from another device and check that two-factor authentication is on.

Something is reopening the page. The usual causes are Safari reopening the tabs from the last session, a site you allowed to send notifications, an extension you did not add, a login item or app that opens a browser, or a redirect from a site you visit often.

Quit Safari and hold Shift while opening it to stop old windows returning, then check the notification list, extensions and website data in Safari Settings, the login items and the Applications folder. Change one thing at a time so you know which it was.

Not for the page itself. A web page leaves nothing on the drive for a scan to remove, so closing the tab and quitting the browser end it. Our 2017 guide said the best way is a reputable anti-malware scan and that manual removal is complicated.

We would put it the other way round: the steps above take minutes and need no download. If an extension, app or login item is the cause, the removal table shows where to find it, and Apple says to download from the App Store or the developer's own site.

Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.

For Mac Detected TAPSNAKE infection, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.

Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.