Seen the Tapsnake virus warning on your Android? Here’s what you need to know

Android scareware warningAre you worried your smartphone might be infected by the Tapsnake Android virus?

Take a deep breath and don’t panic.

Security researchers at Symantec have discovered a series of mobile phone adverts, which attempt to scare users into believing their device has been infected by a Trojan horse called MobileOS/Tapsnake.

The messages, which some users might mistake for a genuine security warning, read:

ANDROID VIRUS DETECTED

A site you recently visited has infected your phone with (Trojan: MobileOS/Tapsnake)

Press OK to remove the threat.

Tapsnake warning

As regular cynical readers of the site have probably already guessed, your smartphone isn’t really infected and this is a ruse to trick you into installing a fake anti-virus (also known as scareware) app.

Fake anti-virus download

Anyone duped into installing the bogus security software runs the risk of compromising their smartphone.

It’s not uncommon to see fake anti-virus scams spread on Windows and Mac, and their Android-based equivalents will typically be monetised by signing you up for premium rate phone services, messing with your browser to earn affiliate cash, or infesting your device with intrusive advertising pop-ups.

It’s worth noting that what makes the fake virus warning message a little more believable is that there really was a piece of Android spyware called Tapsnake, which was first spotted in 2010.

If you made the mistake of installing the real Tapsnake app you would be greeted by a retro “Snake” game, but your location would also be secretly shared with someone who wanted to spy on you.

Handy for jealous partners and stalkers, I guess..

There can be little doubt now that all Android users should seriously consider running an anti-virus program on their smartphones. The only thing to be careful about is that it comes from a legitimate vendor, rather than one of these scareware scam artists.

Further reading: “Android Tapsnake Mobile Scareware: Ads Push Antivirus”, Symantec.

Tags: , , , ,


, , , ,

42 Responses

  1. Crystal December 26, 2013 at 6:03 am #

    Oh i am so glad i read this. i was just hit by this a few
    moments ago. i am so glad i didn't download
    anything!!

    • choochoojake July 20, 2014 at 11:13 pm #

      Me too it came up on a youtube video so iy got me even more mad so i had to restart the video and these tapsnake things have timers what happens at 0 i am worried

    • Miku October 27, 2014 at 3:49 am #

      I JUST got it on my kindle I don't know if I'm SAAFFE! O.o panic alert!!

  2. mel December 29, 2013 at 11:48 pm #

    What happens if you didn't read this first and
    clicked install? I went to my downloads and clicked delete but
    I'm not sure if that would've done
    anything.

    • Daniel January 1, 2014 at 11:12 pm #

      I did this and to be on the safe side you could install an app to remove rooted apps like clean master. Or email the company, I did and got a reply quickly ensuring me I had my details removed

      • Shelley January 8, 2014 at 11:01 pm #

        I have installed clean master and run that. Which company
        did you email as I downloaded but did not complete all the actions
        required. I scanned with AVG which prompted me to delete which I
        did. But not sure if my phone is safe?

      • Joan Simmons January 29, 2014 at 8:35 am #

        I stupidly installed the so called tapsnake free removal program and it cannot be removed no mattet what. I just. bought this straight talk phone about 48 hrs. Ago…should. I return it to the store or w..ho d.o I contact for help ?

        • Randal Goldman October 27, 2014 at 12:01 am #

          Unfortunately i fell for this scam now my phone is "locked up" with someone saying i veiwed and stored child pornand zoophillia and demanding 300 dollars to unlock my phone

          • Nora Ruvalcaba November 22, 2014 at 4:33 pm #

            My younger just got the same thing last night. Is there a way to remove it?

  3. val January 8, 2014 at 5:10 am #

    I did not read this before I clicked download either, however I am experiencing this on a Nook rather than a phone. I clicked the arrow in the bottom left corner and it said the download was complete, and when i clicked on that, it said that to complete the action I had to use App Installer or Package Installer. I clicked App Installer and it said the application could not be installed on my device. Does this mean my Nook is safe?

    • manamismapersinilinfamashion March 19, 2014 at 11:50 pm #

      I just did the exact same thing on my nook. I didn't get any response though, I actually clicked download about five times. I can't find any app on my nook to delete it though. Does this mean I'm okay, or did I just download the tap snake thing. I'm really kind of scared, is it possible some creepy person be stalking me right now? Please, can somebody help me?

  4. Lorraine Carter January 10, 2014 at 2:10 pm #

    THANK YOU!!! I had a suspicion that it was false but still afraid! I was getting ready to have my phone wiped clean.

  5. George auld January 10, 2014 at 11:42 pm #

    Thanks. I started to receive this on my tablet but
    suspected it was a fake warning and googled to see if anything was
    known about it. I would advise others if you get a trojan or virus
    warning google it for details.

  6. Laurie January 11, 2014 at 2:10 am #

    Just got this too, smelled a rat so Googled tapsnake and
    found this site. Bless you!

  7. Freddo January 17, 2014 at 10:34 am #

    Great, its not a virus. So how do i stop this message from popping up???!!

  8. 1SoCalGal January 22, 2014 at 11:00 am #

    I just received a new (used) ereader/tablet today. By all appearances the ereader is brand new, and still had all accessories sealed in their plastic bags, etc. I set up my ID and wifi…pushed on the browser icon, which brought up an 'ereadingsource dot com' site. I assumed it was the ereaders main book site, but before the link fully loaded, this tapsnake scam popped up. I *almost* downloaded it, thinking it was part of the set-up process, until I saw the countdown clock. I then tried to close it, but nothing happened. I tried to return to the home page, but was greeted with a pop-up vid of some naked chicks shaking their boobies & twerking. I tried to close the page, but it brought up a registration page for an apparent porn site. I immediately shut down the device, and reset it to factory settings; However, when I restarted it and opened the browser, I got the tapsnake re-direct again. I'm not too tech-savvy, and don't know how this trojan got into a link that is set up as an app already installed on the ereader.

  9. jonathan wrege January 27, 2014 at 12:21 am #

    I got this message today so I turned on lookout and found no viruses

  10. Leslie January 27, 2014 at 6:21 pm #

    I just got this on my tablet and hit the download to clear virus. Never opened the downloads deleted them all after reading this. Will I be safe?

  11. John Christner January 29, 2014 at 6:31 pm #

    I just got this today. I have Lookout and I downloaded Norton. I cant use Google browser because that stupid pop up comes up. What do I do?? Help

  12. Cathy Hunt January 30, 2014 at 4:30 pm #

    So glad I was suspicious and searched tapsnake virus before I did anything and found your post. Thank you

  13. ramons February 4, 2014 at 6:10 pm #

    thanks alot for everthing now finally i can sleep well..i was so worryed last weeks since i got that viruses warning i never knew if it's true or not i never knew what shall i do all this time. Lucky me i am a suspicious guy and i have never installed their fake antivirus

  14. Dany February 16, 2014 at 6:00 am #

    Thank you all for you great stories i am tired if hearing. Less talk and more work. How do we prevent it, whats the cause of the problem, does it only attack Android users, is an internal app causing it, will a format fix it. We need answers cause no antivirus is fixing anything. Hello people.

  15. jiimy March 7, 2014 at 11:22 pm #

    Thank God that I didn't download

  16. Thankyou March 23, 2014 at 5:59 pm #

    Thankyou so much the pop up just poped up and I came straight here and it really helped

  17. android March 27, 2014 at 7:13 pm #

    Lol, i also install the apps recomemded to me by the site who is telling me my phone is infected and the result i cant view my album,
    They just want us to nstall their anti virus apps w/c is completely useless,,

  18. Trevor April 2, 2014 at 6:45 am #

    I had a strong gut feeling that this was a scam when I first spotted it whilst using the web on my Nexus 7 last weekend. Since I already have the Lookout anti-virus app installed on my device (from the Google Play Store, of course), I quickly swiped out of the web page that I was on (I did NOT do what the scam warning was asking me to do), loaded up Lookout, gave everything on my Nexus 7 a quick and thorough search through…and fortunately, Lookout quickly indicated that everything on my Nexus 7 was safe and completely protected. Panic over! :)

    Very happy and relieved that I instead decided to use my genuine anti-virus protection to remedy this awful scare in the end. Always better to be safe than sorry!

    Thank you so much for highlighting this for so many others in the same situation too. Very helpful of you! :)

  19. Caitlin April 4, 2014 at 10:01 pm #

    Um, Hey I downloaded it and then found this site, so I went to my downloads to get rid of it and it isn't there. Does that mean I didn’t actually get it or is it meant to be hidden? Also does deleting it from the list get rid of it? (Sorry for sounding kinda dumb I’m not really good with technology)

  20. Lima April 19, 2014 at 10:29 am #

    Unfortunately I clicked on the ok which triggered the time clock, but stopped before clicking on the download and instead went looking for answers and landed here.

    Have since uploaded the Lookout app as a precaution. Seems I have the all clear.

    Thanks.

  21. Josh May 19, 2014 at 6:47 am #

    I was browsing through on the Internet and also saw this tapsnake virus. I cant remember if i downloaded it or not as I panicked and didnt know what to do. I also think maybe my phone is weird as it gets hot and its a brand new galaxy. I just randomly thought I would research it more and ended up here. Could I please ask for assistance. It happened bout two weeks ago.

  22. Bob June 13, 2014 at 9:32 pm #

    Enough of all this chatter…what is the solution on removing the pop-up

    • Nico June 16, 2014 at 10:51 pm #

      Just X out of the page and ignore it… DONT DOWNLOAD ANYTHING!!! And just leave it… Forget about it… It's ok as long as ya don't download what it tells ya to!… :)

  23. Nico June 16, 2014 at 10:48 pm #

    So relieved I got a warning like that on my iOS iPad 3 after going on a website I usually visit, it apparently scanned my device and said there is a tapsnake attacking file snake. Something it didn't say anything about a Trojan and told me to download a anti virus iOS 9 point something and I tried to download it but it said ADRESS not valid so I ignored it, came off the site, deleted my history and searched up what a tapsnake is! I've never seen anything like this before! Haha but I'm so happy that it's all a scam and that my devise wouldn't let me download that I'm so lucky!… Phew!

  24. magdalena June 21, 2014 at 11:07 pm #

    hi, just this message poited up pop-up on a really common web site, ut the removal program was called Windowss, I checked the firewall first, than checked the device by the avast, everything was ok, so I denied to install the remover.. hope, the Tapsnake is not there…

  25. cynthia July 1, 2014 at 8:27 am #

    Had this pop-up on my galaxy tablet that told me that it was about something with Trojan ditected a virus that I had to dowloaded so I cliked it to dowload but then it told me that the app was not available in the state that I live . So that means that im save ???? :) so that means I dont have any virus :/

  26. Sophie Taylor July 7, 2014 at 1:12 am #

    I installed it then checked on here I installed avg and it said I have the all clear have got it?

  27. Alan Weiner August 7, 2014 at 10:53 pm #

    After declining the free download and removal software, I have noticed a small file which shows as a download.

  28. Lori September 13, 2014 at 9:24 pm #

    How is this supposed to help without posting a solution to the problem?

  29. Shawn September 25, 2014 at 4:16 am #

    I was having this problem on my Galaxy S4 and fixed it as follows:

    Open your web browser. Go to settings. Choose Content Settings. Choose Website Settings. Click on the web address that keeps popping up. Select Clear Stored Data. This ended the pop-ups for me.

  30. Evan Joubert October 10, 2014 at 2:02 pm #

    I got this to. The way I got rid of the popups and tapsnake is to open the browser on my Galaxy S4 Mini, select the windows icon(little blank rectangles in the top right corner of the browser) on the screen pinch the screen to the middle and all your open windows of visited websites will minimize and close the one that causing the popups by tapping on the – sign of the minimized website window. Your phone is not infected. It is the open website window containing the tapsnake popup that is causing the popups.
    Deleting and clearing browser history does not close the open browser windows but does prevent the popups from appearing until you visit the website again! Apparently when you browse from one website to another the previous website window you visited does not automatically close.

  31. Hello October 25, 2014 at 8:13 am #

    Hello I clicked download and it took me to this thing that told me to click install and I didn't click install do I have it?

  32. brat brat November 18, 2014 at 1:26 pm #

    I started receiving this message and suspected it to be bogus cause I have never surfed any porn sites at the point they asked to have me download something I closed it out and went to Google play downloaded several av and found nothing on phone.however the last two apps I downloaded seemed to have a lot of adware MX player and bit torrent I deleted them both…no more problems.I am so tired of malicious people trying to scam others like that guy with the India accent claiming to be with Microsoft wanting me to set up an remote desktop so he can (fix) it.I told him (some countries cut your hands off for thievery) he hasn't called back.

  33. Dave November 27, 2014 at 2:23 pm #

    Thank you for this site! The same message popped up on my Samsung Galaxy. On your advise, I just closed that window and it hasn't popped up since.

Leave a Reply

XSLT by CarLake