New tab opened suddenly stating an "urgent" Firefox update - legit or hoax?
When I was already engaged in another open Firefox tab, a new tab suddenly opened stating it was an "urgent" Firefox update and asked me to install software (for which an application widow then opened).
Is this legitimate or a hoax, the sign of some malware, virus, etc?
Naturally I would want to comply if Firefox really did have some new important update. But I could find nothing about this "urgent" update when I searched in Firefox for info. about it. The first thing I did was to go to the "About Firefox" item in the Help menu, saw that the system said "up-to-date," even clicked on "What' New" but saw nothing about an urgent update.
Please advise on how to get to the bottom of why this tab suddenly popped open, to prevent such from happening again.
Chosen solution
It is a 100% Fake Firefox update popup. You can get this by chance even if Windows is not infected. Similar ones are done for various Plugins such as Flash Player and Java.
Firefox 47.0 is the current Release.
Firefox updates whether for Windows, Mac OSX or Linux are done internally in Firefox itself (with a .mar file as you can see here for example) and by download from mozilla.org like say http://www.mozilla.org/firefox/all/
There is no such thing as Firefox_update.exe or Firefox_patch.exe or such similar names of exe and these are always from random sites as scammers have been using this tactic every so often in last few years to try and trick inexperienced Windows and or Firefox users into downloading and infecting their Windows if they run the said .exe
virustotal always found these fake exe's to be trojans, viruses and such malware.
Read this answer in context 👍 30All Replies (8)
Chosen Solution
It is a 100% Fake Firefox update popup. You can get this by chance even if Windows is not infected. Similar ones are done for various Plugins such as Flash Player and Java.
Firefox 47.0 is the current Release.
Firefox updates whether for Windows, Mac OSX or Linux are done internally in Firefox itself (with a .mar file as you can see here for example) and by download from mozilla.org like say http://www.mozilla.org/firefox/all/
There is no such thing as Firefox_update.exe or Firefox_patch.exe or such similar names of exe and these are always from random sites as scammers have been using this tactic every so often in last few years to try and trick inexperienced Windows and or Firefox users into downloading and infecting their Windows if they run the said .exe
virustotal always found these fake exe's to be trojans, viruses and such malware.
Modified by James
If you get a pop-up message asking to update Firefox or plugins or scanning for malware then such a message is likely a scam and you should never respond to such an alert to avoid getting infected with malware.
- Only update Firefox via "Help > About" or by downloading and installing Firefox from the Mozilla server and never via a pop-up or link on a web page.
- plugins should only be updated via the plugin itself or by visiting the home page of the plugin.
You can find the full version of the current Firefox release (47.0) in all languages and all operating systems here:
I'm seeing this daily on one of my PCs between Noon and 1PM EDST.
This only happens when I'm on my ISPs webpage and the address of the slime-balls producing it changes daily. Today it was: https://aezaecommonsensehome.net/1801191426960/3bfbbf4372a7f250d1adea692927d685.html
The page looks like the one attached each time it appears. Another interesting thing with this is that page leaves no trace in the Firefox Browser History.
Does anyone know how to stop this page from appearing?
It is interesting you find this only happens when you are on your ISPs webpage. Do you think the webpage might be carrying an infectious ad ? It seems that if a new tab is generated, then some exploit has taken control of Firefox. I recently am having the same problem and I am concerned it is a security flaw in Firefox. Hoiwever, my instances did not occur at 12-1 pm EDT. I will take note in future if it occurs again of the time and specific websites I'm on.
marie15,
Not a security flaw in Firefox - nothing bad will happen without "you" installing the fake "update". As James mentioned weeks ago, that type of exploit is trying to scare inexperienced / naive users into installing that fake "patch".
That garbage is easily blocked by an ad blocker such as uBlock Origin. https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/ But if you choose not to install an ad blocker, you can report the URL of that malicious website via Help > Report deceptive website ... from tright inside of Firefox.
Firefox has had Anti-Malware / Anti-phishing 'protection' since 2007; partnering with Google in the SafeBrowsing feature that both use.
marie15 said
It is interesting you find this only happens when you are on your ISPs webpage. Do you think the webpage might be carrying an infectious ad ? It seems that if a new tab is generated, then some exploit has taken control of Firefox. I recently am having the same problem and I am concerned it is a security flaw in Firefox. Hoiwever, my instances did not occur at 12-1 pm EDT. I will take note in future if it occurs again of the time and specific websites I'm on.
I posted this question in the Norton.com forums and one of the folks responding there suggested these are probably appearing due to a javascript exploit and they suggested installing and using the "Noscript" addon for Firefox.
Apparently my ISP or what ever advertiser that was infected removed or resolved the problem because I haven't seen it for a few days now.
the-edmeister said
marie15, Not a security flaw in Firefox - nothing bad will happen without "you" installing the fake "update". As James mentioned weeks ago, that type of exploit is trying to scare inexperienced / naive users into installing that fake "patch". That garbage is easily blocked by an ad blocker such as uBlock Origin. https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/ But if you choose not to install an ad blocker, you can report the URL of that malicious website via Help > Report deceptive website ... from tright inside of Firefox. Firefox has had Anti-Malware / Anti-phishing 'protection' since 2007; partnering with Google in the SafeBrowsing feature that both use.
Hi the-edmeister, Thank you very much for your quick response. There are so many attacks per week it is too dangerous and disruptive to my work to just rely on my not clicking on the install. The first time I got one of these attacks I am not aware that I clicked on the install but it downloaded anyway. Maybe I was clicking or doing carriage return on another page and when the exploit generated the new tab it jumped to the foreground and hijacked that command - something like that. It happens very suddenly.
I'm definitely going to install an adblock program. I found someone who has a similar setup to me (Firefox, Windows 10 and Kaspersky), and hasn't had this problem, they have AdBlock Plus so maybe that makes the difference. Elsewhere I am reading it might be a javascript exploit and I should install No Script Security Suite. I am looking into that as well.
Thanks again.
Steve E said
marie15 saidIt is interesting you find this only happens when you are on your ISPs webpage. Do you think the webpage might be carrying an infectious ad ? It seems that if a new tab is generated, then some exploit has taken control of Firefox. I recently am having the same problem and I am concerned it is a security flaw in Firefox. Hoiwever, my instances did not occur at 12-1 pm EDT. I will take note in future if it occurs again of the time and specific websites I'm on.I posted this question in the Norton.com forums and one of the folks responding there suggested these are probably appearing due to a javascript exploit and they suggested installing and using the "Noscript" addon for Firefox.
Apparently my ISP or what ever advertiser that was infected removed or resolved the problem because I haven't seen it for a few days now.
Hi Steve, Thanks for your quick reply. I got the problem 3 times this week and a lot of people on this site are reporting it. It seems to be very prevalent since I got it from different websites. The forum reports a TV website, you had your ISP, and I believe I got it from some respected newssites. The perpetrators are buying a new URL every few days according to comments I've seen on the forum. Taken together, I feel it warrants serious countermeasures - with so many attacks, the risk of one succeeding is too great otherwise. I found a friend with a similar setup to mine has had no problems and they have AdBlock Plus. So I will definitely install that. I will look into NoScript as well - thanks for sharing that info. Thanks again.