Seen the Tapsnake virus warning on your Android? Here’s what you need to know

Android scareware warningAre you worried your smartphone might be infected by the Tapsnake Android virus?

Take a deep breath and don’t panic.

Security researchers at Symantec have discovered a series of mobile phone adverts, which attempt to scare users into believing their device has been infected by a Trojan horse called MobileOS/Tapsnake.

The messages, which some users might mistake for a genuine security warning, read:

ANDROID VIRUS DETECTED

A site you recently visited has infected your phone with (Trojan: MobileOS/Tapsnake)

Press OK to remove the threat.

Tapsnake warning

As regular cynical readers of the site have probably already guessed, your smartphone isn’t really infected and this is a ruse to trick you into installing a fake anti-virus (also known as scareware) app.

Fake anti-virus download

Anyone duped into installing the bogus security software runs the risk of compromising their smartphone.

It’s not uncommon to see fake anti-virus scams spread on Windows and Mac, and their Android-based equivalents will typically be monetised by signing you up for premium rate phone services, messing with your browser to earn affiliate cash, or infesting your device with intrusive advertising pop-ups.

It’s worth noting that what makes the fake virus warning message a little more believable is that there really was a piece of Android spyware called Tapsnake, which was first spotted in 2010.

If you made the mistake of installing the real Tapsnake app you would be greeted by a retro “Snake” game, but your location would also be secretly shared with someone who wanted to spy on you.

Handy for jealous partners and stalkers, I guess..

There can be little doubt now that all Android users should seriously consider running an anti-virus program on their smartphones. The only thing to be careful about is that it comes from a legitimate vendor, rather than one of these scareware scam artists.

Further reading: “Android Tapsnake Mobile Scareware: Ads Push Antivirus”, Symantec.

Tags: , , , ,


, , , ,

35 Responses

  1. Crystal December 26, 2013 at 6:03 am #

    Oh i am so glad i read this. i was just hit by this a few
    moments ago. i am so glad i didn't download
    anything!!

    • choochoojake July 20, 2014 at 11:13 pm #

      Me too it came up on a youtube video so iy got me even more mad so i had to restart the video and these tapsnake things have timers what happens at 0 i am worried

  2. mel December 29, 2013 at 11:48 pm #

    What happens if you didn't read this first and
    clicked install? I went to my downloads and clicked delete but
    I'm not sure if that would've done
    anything.

    • Daniel January 1, 2014 at 11:12 pm #

      I did this and to be on the safe side you could install an app to remove rooted apps like clean master. Or email the company, I did and got a reply quickly ensuring me I had my details removed

      • Shelley January 8, 2014 at 11:01 pm #

        I have installed clean master and run that. Which company
        did you email as I downloaded but did not complete all the actions
        required. I scanned with AVG which prompted me to delete which I
        did. But not sure if my phone is safe?

      • Joan Simmons January 29, 2014 at 8:35 am #

        I stupidly installed the so called tapsnake free removal program and it cannot be removed no mattet what. I just. bought this straight talk phone about 48 hrs. Ago…should. I return it to the store or w..ho d.o I contact for help ?

  3. val January 8, 2014 at 5:10 am #

    I did not read this before I clicked download either, however I am experiencing this on a Nook rather than a phone. I clicked the arrow in the bottom left corner and it said the download was complete, and when i clicked on that, it said that to complete the action I had to use App Installer or Package Installer. I clicked App Installer and it said the application could not be installed on my device. Does this mean my Nook is safe?

    • manamismapersinilinfamashion March 19, 2014 at 11:50 pm #

      I just did the exact same thing on my nook. I didn't get any response though, I actually clicked download about five times. I can't find any app on my nook to delete it though. Does this mean I'm okay, or did I just download the tap snake thing. I'm really kind of scared, is it possible some creepy person be stalking me right now? Please, can somebody help me?

  4. Lorraine Carter January 10, 2014 at 2:10 pm #

    THANK YOU!!! I had a suspicion that it was false but still afraid! I was getting ready to have my phone wiped clean.

  5. George auld January 10, 2014 at 11:42 pm #

    Thanks. I started to receive this on my tablet but
    suspected it was a fake warning and googled to see if anything was
    known about it. I would advise others if you get a trojan or virus
    warning google it for details.

  6. Laurie January 11, 2014 at 2:10 am #

    Just got this too, smelled a rat so Googled tapsnake and
    found this site. Bless you!

  7. Freddo January 17, 2014 at 10:34 am #

    Great, its not a virus. So how do i stop this message from popping up???!!

  8. 1SoCalGal January 22, 2014 at 11:00 am #

    I just received a new (used) ereader/tablet today. By all appearances the ereader is brand new, and still had all accessories sealed in their plastic bags, etc. I set up my ID and wifi…pushed on the browser icon, which brought up an 'ereadingsource dot com' site. I assumed it was the ereaders main book site, but before the link fully loaded, this tapsnake scam popped up. I *almost* downloaded it, thinking it was part of the set-up process, until I saw the countdown clock. I then tried to close it, but nothing happened. I tried to return to the home page, but was greeted with a pop-up vid of some naked chicks shaking their boobies & twerking. I tried to close the page, but it brought up a registration page for an apparent porn site. I immediately shut down the device, and reset it to factory settings; However, when I restarted it and opened the browser, I got the tapsnake re-direct again. I'm not too tech-savvy, and don't know how this trojan got into a link that is set up as an app already installed on the ereader.

  9. jonathan wrege January 27, 2014 at 12:21 am #

    I got this message today so I turned on lookout and found no viruses

  10. Leslie January 27, 2014 at 6:21 pm #

    I just got this on my tablet and hit the download to clear virus. Never opened the downloads deleted them all after reading this. Will I be safe?

  11. John Christner January 29, 2014 at 6:31 pm #

    I just got this today. I have Lookout and I downloaded Norton. I cant use Google browser because that stupid pop up comes up. What do I do?? Help

  12. Cathy Hunt January 30, 2014 at 4:30 pm #

    So glad I was suspicious and searched tapsnake virus before I did anything and found your post. Thank you

  13. ramons February 4, 2014 at 6:10 pm #

    thanks alot for everthing now finally i can sleep well..i was so worryed last weeks since i got that viruses warning i never knew if it's true or not i never knew what shall i do all this time. Lucky me i am a suspicious guy and i have never installed their fake antivirus

  14. Dany February 16, 2014 at 6:00 am #

    Thank you all for you great stories i am tired if hearing. Less talk and more work. How do we prevent it, whats the cause of the problem, does it only attack Android users, is an internal app causing it, will a format fix it. We need answers cause no antivirus is fixing anything. Hello people.

  15. jiimy March 7, 2014 at 11:22 pm #

    Thank God that I didn't download

  16. Thankyou March 23, 2014 at 5:59 pm #

    Thankyou so much the pop up just poped up and I came straight here and it really helped

  17. android March 27, 2014 at 7:13 pm #

    Lol, i also install the apps recomemded to me by the site who is telling me my phone is infected and the result i cant view my album,
    They just want us to nstall their anti virus apps w/c is completely useless,,

  18. Trevor April 2, 2014 at 6:45 am #

    I had a strong gut feeling that this was a scam when I first spotted it whilst using the web on my Nexus 7 last weekend. Since I already have the Lookout anti-virus app installed on my device (from the Google Play Store, of course), I quickly swiped out of the web page that I was on (I did NOT do what the scam warning was asking me to do), loaded up Lookout, gave everything on my Nexus 7 a quick and thorough search through…and fortunately, Lookout quickly indicated that everything on my Nexus 7 was safe and completely protected. Panic over! :)

    Very happy and relieved that I instead decided to use my genuine anti-virus protection to remedy this awful scare in the end. Always better to be safe than sorry!

    Thank you so much for highlighting this for so many others in the same situation too. Very helpful of you! :)

  19. Caitlin April 4, 2014 at 10:01 pm #

    Um, Hey I downloaded it and then found this site, so I went to my downloads to get rid of it and it isn't there. Does that mean I didn’t actually get it or is it meant to be hidden? Also does deleting it from the list get rid of it? (Sorry for sounding kinda dumb I’m not really good with technology)

  20. Lima April 19, 2014 at 10:29 am #

    Unfortunately I clicked on the ok which triggered the time clock, but stopped before clicking on the download and instead went looking for answers and landed here.

    Have since uploaded the Lookout app as a precaution. Seems I have the all clear.

    Thanks.

  21. Josh May 19, 2014 at 6:47 am #

    I was browsing through on the Internet and also saw this tapsnake virus. I cant remember if i downloaded it or not as I panicked and didnt know what to do. I also think maybe my phone is weird as it gets hot and its a brand new galaxy. I just randomly thought I would research it more and ended up here. Could I please ask for assistance. It happened bout two weeks ago.

  22. Bob June 13, 2014 at 9:32 pm #

    Enough of all this chatter…what is the solution on removing the pop-up

    • Nico June 16, 2014 at 10:51 pm #

      Just X out of the page and ignore it… DONT DOWNLOAD ANYTHING!!! And just leave it… Forget about it… It's ok as long as ya don't download what it tells ya to!… :)

  23. Nico June 16, 2014 at 10:48 pm #

    So relieved I got a warning like that on my iOS iPad 3 after going on a website I usually visit, it apparently scanned my device and said there is a tapsnake attacking file snake. Something it didn't say anything about a Trojan and told me to download a anti virus iOS 9 point something and I tried to download it but it said ADRESS not valid so I ignored it, came off the site, deleted my history and searched up what a tapsnake is! I've never seen anything like this before! Haha but I'm so happy that it's all a scam and that my devise wouldn't let me download that I'm so lucky!… Phew!

  24. magdalena June 21, 2014 at 11:07 pm #

    hi, just this message poited up pop-up on a really common web site, ut the removal program was called Windowss, I checked the firewall first, than checked the device by the avast, everything was ok, so I denied to install the remover.. hope, the Tapsnake is not there…

  25. cynthia July 1, 2014 at 8:27 am #

    Had this pop-up on my galaxy tablet that told me that it was about something with Trojan ditected a virus that I had to dowloaded so I cliked it to dowload but then it told me that the app was not available in the state that I live . So that means that im save ???? :) so that means I dont have any virus :/

  26. Sophie Taylor July 7, 2014 at 1:12 am #

    I installed it then checked on here I installed avg and it said I have the all clear have got it?

  27. Alan Weiner August 7, 2014 at 10:53 pm #

    After declining the free download and removal software, I have noticed a small file which shows as a download.

  28. Lori September 13, 2014 at 9:24 pm #

    How is this supposed to help without posting a solution to the problem?

  29. Shawn September 25, 2014 at 4:16 am #

    I was having this problem on my Galaxy S4 and fixed it as follows:

    Open your web browser. Go to settings. Choose Content Settings. Choose Website Settings. Click on the web address that keeps popping up. Select Clear Stored Data. This ended the pop-ups for me.

Leave a Reply

XSLT by CarLake