Fake Apple Pay charge brings the classic tech support scam to your phone

This is a well-executed mobile variant of the classic tech support scam, weaponizing browser lockouts and fake payment notifications to bypass user skepticism.

Technical Breakdown

• Initial Vector: Malicious ads (malvertising) or compromised sites redirect the user’s mobile browser.
• Browser Lockout: The page enters full-screen mode and spawns a loop of system-style dialogs, preventing the user from closing the tab or navigating away.
• Social Engineering Payload: A fake Apple Pay receipt notification is displayed, claiming a fraudulent charge (e.g., $99.99 for Norton/McAfee). This creates urgency.
• Call to Action: A prominent phone number is displayed, instructing the victim to “call Apple Support immediately to dispute the charge.”
• TTPs: Abuse of beforeunload event, fullscreen API, and persistent alert() loops. This maps to T1566.002 (Phishing: Spearphishing Link) and T1497.003 (Virtualization/Sandbox Evasion: Time Based Evasion) via the lockout mechanism.
• IOCs: The scam phone numbers are disposable VOIP lines; the landing domains are typically short-lived, randomized subdomains on compromised or bulletproof hosting.

Defense

• User Education: The single most effective control. Users must know that legitimate Apple Pay charges appear in the Wallet app, not as a browser popup.
• Browser Hardening: Disable “Enable automatic downloads” and consider using a content blocker on mobile Safari/Chrome. On iOS, force-quitting Safari via the app switcher breaks the fullscreen lockout loop.
• Detection: Monitor for high volumes of alert() or confirm() dialogs from a single browser session. This is a behavioral indicator, not a signature.

Source: https://www.malwarebytes.com/blog/scams/2026/08/fake-apple-pay-charge-brings-the-classic-tech-support-scam-to-your-phone