iMac and iPad infected last night. Screen was taken over with notice that a virus infected iMac.

[3Hotdogs]

It had poor punctuation and am m1-888 number I needed to call in order to resolve the problem. Re-boots didn't resolve the problem.

iPhone wasn't affected..

Then about 2 hours later, it went away.

Thoughts?

[hlthe2b]

1. Do you have an apple store nearby? If this is occuring widely, I'd imagine they've encountered it.

But, the past two IOS updates for iphone and Ipad (maybe Mac) have been "emergency" updates for a serious security issue, so I'd not assume it is resolved.

[ItsjustMe]

2. Macs now twice as likely to get infected by adware than PCs, according to research

https://www.pcgamer.com/macs-now-twice-as-likely-to-get-infected-by-adware-than-pcs-according-to-research/

[ret5hd]

4. Adware is a lot different than a virus.

Just sayin’.

[kimbutgar]

3. I updated my IPad and couldn't get it to start up past the welcome

So I took a small needle and poked the small hole next to the two volume knobs and was able to get it to reboot.

I suspect a virus hit my iPad.

[Hokie]

5. Have you updated to iOS 14.8?

I think that update was pushed out last week to fix some really bad malware that showed up.

[3Hotdogs]

6. Yes, it was updated.

Interesting part (to me), it infected both the Mac and Pad even though the pad wasn't turned on. Yet it didn't it the iPhone.

[SoCalNative]

7. iOS 15

is now available.

[SeattleVet]

8. If you got a popup with a number to call, it's almost certainly a scam.

Been going around for a while now.

Do NOT call the number.

There are plenty of YouTube videos (various scam-baiters and scambusters) where they follow through and contact the scammers.

The popups would have probably gone away if you had cleared your browser caches when you rebooted.

[CloudWatcher]

9. Missing info ...

I'm pretty confused about what you're observing. Did the Mac's screen get "taken over" as soon as you rebooted? Or did it only happen once you've launched a browser?

Infecting an iPad while it's turned off is quite a trick (i.e. my skeptical flag has been raised pretty high). Note a "locked screen" is not turned off. That's just a low power mode with the screen off (usually locked). Some background processing is allowed in this mode.

Most likely though ... I can imagine that if your browser settings (bookmarks) are sync'd between the Mac and iPad (via sharing Safari info with iCloud on both devices) ... then if Safari on your Mac has been screwed up, those settings could be shared with the iPad the next time you used it.

But ... otherwise I'm drawing a blank how your iPad could have been "infected" while turned off (we'll ignore Pegasus for now, it's not likely you were a target of the people that had that available, and they didn't try and scam with an 888 number).

If the offending source was really something on the network, then any number of changes could have been responsible for it going away. E.g. an infected web site should have been shut down (or added to Apple's block-'em list). Or the domain-name system could have been fixed (e.g. routing "www.cnn.com" to an offending site).

Of course the very last thing you every want to do is call the 888 number for "help". They're the bad guys.

It wouldn't hurt to make sure that all your Apple devices are running the latest software. And .. make sure your internet router (usually a WiFi base station) is also updated to their latest firmware.

If you don't know how to check, get some help

[3Hotdogs]

10. It was taken over, days after the last reboot. It happened when I tried to logon to Amazon.com

Screen on iAd was locked. Unit was not turned off.

iPad and iMac are sync'd but so is iPhone. Phone did not get "hit."

Thanks for info.

[CloudWatcher]

11. Ah, so your browser was locked up

The good news is that your devices (Mac, iPad, iPhone, router) are mostly likely just fine.

It's really pretty easy for the bad guys to publish a web page that "takes over" your screen and tries to prevent you from leaving (while putting up a phone number to call for "help" ).

I believe they often appear from ad sites that others (e.g. amazon.com) serve up in addition to their actual home page.

Since your Mac and iPad (and iPhone) share web browser history they could easily appear to both be hit at the same time. And just luck-of-the-draw that the iPhone wasn't hit as well.

Most useful thing to do: learn how to kill your browser when it's locked up like this.

On the Mac, you can tell the 'Finder' to "Force Quit..." and pick Safari. Then hold the shift key down when you relaunch Safari and you should be fine.

On the iPhone & iPad you can double-click the home button and then swipe up to kill off a process. When you launch again, if it's still trapped, do the kill again, but then use the Settings app to clear the Safari cache before starting it up again.

There's a really good reference & description for all of this in the Apple forum message:

Phony "tech support" / "ransomware" popups and web pages
https://discussions.apple.com/docs/DOC-8071