Phishing: Pop Ups

Phishing pop-ups are fake browser alerts or windows designed to trick you into:

They often look urgent or scary—e.g., “Your computer is infected!” or “Your account has been locked.”

You might think your antivirus or Google Safe Browsing protects you. Think again. phishing pop ups

Attackers are now using adversarial clicks via Google Ads. A user searches for "QuickBooks support." The first result is a paid advertisement. The user clicks the ad, which loads a legitimate-looking website. After 10 seconds, a phishing pop up loads over the real website using a JavaScript overlay. Because the initial click came from a Google ad, the attacker bypassed email filters and URL scanners entirely.

Furthermore, attackers use polyglot files delivered via pop up downloads. A file might be named Invoice.pdf.exe. Windows hides the ".exe" by default, so the user sees Invoice.pdf and double-clicks it, triggering malware. Phishing pop-ups are fake browser alerts or windows

Look closely at the address bar. A true phishing pop up often spawns in a new window where the URL is subtly wrong. You might see rnicrosoft.com instead of microsoft.com, or a long subdomain like support-apple.id.verify-login.com.

function onPopupDetected(popupWindow, sourceTab) 
  const popupUrl = new URL(popupWindow.url);
  const parentUrl = new URL(sourceTab.url);
// Rule 1: Cross-origin pop-up asking for credentials
if (popupUrl.origin !== parentUrl.origin) unusual activity/i.test(popupWindow.document.body.innerText); They often look urgent or scary—e
if (hasLoginForm && hasUrgencyText) 
  blockAndWarn(popupWindow, "Suspicious cross-origin login pop-up");
  return;


// Rule 2: Known phishing domain
if (isPhishingDomain(popupUrl.hostname)) 
blockAndWarn(popupWindow, "This domain is listed in our phishing database");
return;

// Rule 3: Fake brand impersonation
const brandMatch = detectBrandImpersonation(popupWindow.document, parentUrl);
if (brandMatch) 
blockAndWarn(popupWindow, This pop-up impersonates $brandMatch);
return;