{"id":360218,"date":"2025-10-02T05:53:35","date_gmt":"2025-10-02T05:53:35","guid":{"rendered":"https:\/\/malwaretips.com\/blogs\/?p=360218"},"modified":"2025-10-02T05:53:40","modified_gmt":"2025-10-02T05:53:40","slug":"email-on-hold-scam","status":"publish","type":"post","link":"https:\/\/malwaretips.com\/blogs\/email-on-hold-scam\/","title":{"rendered":"Beware: Email On Hold Scam Claims You Have Pending Messages"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">An email lands in your inbox with the subject <strong>\u201cEMAIL ON HOLD\u201d<\/strong> or something similar. Its design looks clean, it claims there are <strong>13 pending messages<\/strong>, and a large button urges you to <strong>\u201cView Pending Emails.\u201d<\/strong> The language is urgent: read and respond promptly. Your heart skips because one of those messages might be an invoice, a bank notice, or a work update. You click \u2014 and suddenly you\u2019ve handed your login credentials to attackers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This scenario is not hypothetical. The <strong>\u201cEmail On Hold\u201d<\/strong> phishing campaign is one of many increasingly convincing scams that prey on urgency and trust. In this article you\u2019ll find a complete breakdown of the scam: an in-depth overview, a step-by-step explanation of how it works, exact actions to take if you were targeted or compromised, and practical prevention strategies to keep your accounts safe. Read on \u2014 quickly, but carefully \u2014 because speed matters if your credentials have already been exposed.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"594\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2025\/10\/scam-1-2-1024x594.jpg\" alt=\"\" class=\"wp-image-360219\" title=\"\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2025\/10\/scam-1-2-1024x594.jpg 1024w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2025\/10\/scam-1-2-300x174.jpg 300w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2025\/10\/scam-1-2.jpg 1280w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Scam Overview<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The <strong>\u201cEmail On Hold\u201d<\/strong> scam is a phishing campaign that impersonates email service notifications to trick recipients into disclosing login credentials. It uses the appearance and tone of administrative mail \u2014 a subject line formatted like an automated system alert, a clean layout with a prominent call-to-action button, and a small table listing alleged pending messages \u2014 to appear legitimate. The message claims that several messages were not delivered to the inbox and are currently <strong>pending<\/strong> or held for review. The recipient is urged to click a button such as <strong>\u201cView Pending Emails\u201d<\/strong> or <strong>\u201cDeliver Messages to Inbox\u201d<\/strong> to release those messages.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Phishers choose this framing for several reasons:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>High perceived urgency.<\/strong> Users worry about missing invoices, payment confirmations, job offers, or other time-sensitive correspondence.<\/li>\n\n\n\n<li><strong>Low suspicion.<\/strong> The email mimics the look and language of common system alerts and often includes typical elements such as timestamps, a recipient field, and a professional footer that mentions a webmail product (e.g., Roundcube) or a corporate-sounding legal line.<\/li>\n\n\n\n<li><strong>Broad applicability.<\/strong> The concept of \u201cpending\u201d or \u201con hold\u201d messages applies to nearly all email users, so the campaign scales easily.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Attackers use one or more of the following delivery methods for this scam:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Mass phishing campaigns<\/strong> sent from disposable or compromised mail servers.<\/li>\n\n\n\n<li><strong>Spoofing<\/strong> the display name so it resembles a legitimate service while the underlying sending domain is fake.<\/li>\n\n\n\n<li><strong>Targeted phishing<\/strong> against specific organizations (spear-phishing), where subject lines and content are tailored to increase credibility.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">The core objective is credential harvesting. The \u201cView Pending Emails\u201d button takes the target to a fake login page. That page is designed to look like the victim\u2019s email provider or a generic webmail login. When the user types a username and password, the data is captured and transmitted to the attacker. In more sophisticated variants, the fake page may also request multi-factor authentication (MFA) codes or redirect to a second page instructing the user to verify identity using an SMS code \u2014 a trick to capture one-time passcodes or to prompt users into disabling MFA.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Once attackers have the credentials, they may:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Log into the victim\u2019s email account to harvest sensitive messages or attachments.<\/li>\n\n\n\n<li>Reset passwords on services that use email-based password recovery.<\/li>\n\n\n\n<li>Send further phishing emails from a trusted address to that user\u2019s contacts (amplifying the attack).<\/li>\n\n\n\n<li>Use the account for financial fraud, business email compromise (BEC), or identity theft.<\/li>\n\n\n\n<li>Sell credentials on dark web markets.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Although the initial email often includes fabricated details to enhance credibility (number of unread messages, timestamps, subject labels), all claims are false. No legitimate email provider will ask users to click a link in an unsolicited email to recover or release messages under threat of service interruption. This scam leverages the human factors of hurry, worry, and reliance on email for critical communication.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How the Scam Works \u2014 Step-by-Step (Detailed)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Below is a granular, step-by-step walkthrough of how an attacker creates and operationalizes an \u201cEmail On Hold\u201d phishing campaign. Understanding each stage helps you spot signs of a scam and respond quickly if targeted.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1 \u2014 Preparation and Infrastructure<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Attackers prepare by setting up the infrastructure needed to send convincing phishing emails and to receive stolen credentials. This includes:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Phishing domains:<\/strong> Attackers register domain names that look similar to common email providers (for example, using subtle typos or extra words) or they host landing pages on compromised websites that evade easy detection.<\/li>\n\n\n\n<li><strong>Email servers:<\/strong> They use misconfigured SMTP relays, disposable VPS hosts, or compromised mail servers to send large volumes of mail.<\/li>\n\n\n\n<li><strong>Phishing kits and templates:<\/strong> Ready-made phishing kits, commonly available in cybercriminal markets, provide the HTML templates and backend scripts for capturing credentials. The kits often include responsive, mobile-friendly designs to mimic popular webmail UIs.<\/li>\n\n\n\n<li><strong>Tracking mechanisms:<\/strong> Attackers often include unique tracking tokens in each email so they can monitor which messages were opened and which victims clicked the links.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2 \u2014 Crafting the Email<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The phisher crafts the email with the following elements:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Subject:<\/strong> Variations include \u201cEMAIL ONHOLD,\u201d \u201cEmail On Hold,\u201d \u201cIncoming Mail On Hold,\u201d or \u201cALERT: EMAILS PENDING.\u201d This text is intended to trigger immediate concern.<\/li>\n\n\n\n<li><strong>Header\/Timestamp:<\/strong> A line like \u201cNotifications 7:13 PM \/ Pending \/ September 28, 2025\u201d is inserted to look like a system log.<\/li>\n\n\n\n<li><strong>Prominent title:<\/strong> An on-email banner reading \u201cEMAIL ONHOLD\u201d or \u201cEmail On Hold\u201d gives a corporate notification look.<\/li>\n\n\n\n<li><strong>Table of pending messages:<\/strong> A small table lists unread messages (e.g., \u201cUnread Messages: 13 pending messages,\u201d \u201cLatest: Saturday, 28\/09\/2025 | 7:13:59 PM\u201d) and a blurred or redacted \u201cRecipient\u201d field. The table mimics legitimate quarantine or spam folder summaries.<\/li>\n\n\n\n<li><strong>Call to action:<\/strong> A large button \u2014 \u201cView Pending Emails\u201d \u2014 in green or blue is placed centrally to attract clicks.<\/li>\n\n\n\n<li><strong>Footer copy:<\/strong> A formal footer mentioning a webmail vendor, copyright, or privacy notice adds perceived legitimacy.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3 \u2014 Delivery<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The email is delivered to recipients in bulk or targeted subsets. Delivery tactics may include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Spray-and-pray:<\/strong> Thousands to millions of emails sent broadly to hit as many possible inboxes.<\/li>\n\n\n\n<li><strong>Targeted lists:<\/strong> Attackers purchase or compile lists of email addresses, sometimes from data breaches, to increase hit rates.<\/li>\n\n\n\n<li><strong>Compromising accounts:<\/strong> If attackers have access to compromised corporate mailboxes, they can send the phishing messages from trusted internal addresses \u2014 a highly effective but dangerous method.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4 \u2014 The Click: Redirect to Phishing Landing Page<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">When a recipient clicks the button, they are redirected to a landing page under the attacker\u2019s control. Techniques used at this stage:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>URL cloaking:<\/strong> The clickable button text may look like a genuine link; hovering over it (on desktop) reveals a suspicious URL. Attackers increasingly use shortened URLs or domain names with visually similar characters to hide the true destination.<\/li>\n\n\n\n<li><strong>SSL certificate usage:<\/strong> Many phishing pages now serve over HTTPS (with a padlock icon) because SSL certificates are cheap and widely available. The padlock only indicates encryption, not legitimacy, so users often mistake it for trust.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5 \u2014 The Fake Login Page<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The phishing landing page imitates the look-and-feel of a real webmail login. Common elements:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Service logo:<\/strong> The attacker copies a provider\u2019s logo or uses a neutral, clean header.<\/li>\n\n\n\n<li><strong>Input fields:<\/strong> Prompts for email\/username and password. Some pages ask for secondary verification details.<\/li>\n\n\n\n<li><strong>Hidden scripts:<\/strong> The backend uses scripts to capture entered credentials and store them in remote databases or forward them via email to the attacker.<\/li>\n\n\n\n<li><strong>Deceptive behaviors:<\/strong> After credential submission, phishing pages often display error messages (\u201cSession timed out \u2014 please log in again\u201d) or redirect to the real email provider to reduce suspicion and buy time for attackers to act.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6 \u2014 Credential Capture and Validation<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Once credentials are submitted:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Immediate capture:<\/strong> The phish server records credentials (username\/password) and typically logs metadata such as IP address, timestamp, and user agent.<\/li>\n\n\n\n<li><strong>Credential validation:<\/strong> Many phishing systems attempt to validate credentials in near real-time by automatically trying to log into the provider (or use the credentials on common services). If validation succeeds, attackers mark the victim as \u201cvalid\u201d and prioritize follow-up.<\/li>\n\n\n\n<li><strong>Secondary harvesting:<\/strong> If the phishing kit requests MFA codes or secondary authentication, attackers capture these too \u2014 sometimes by instructing the victim to copy and paste an SMS or authenticator code under the guise of re-verification.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Step 7 \u2014 Exploitation of Access<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Armed with valid credentials, attackers can immediately:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Access the inbox:<\/strong> Reading messages, downloading attachments, harvesting bank statements, invoices, contracts, tax documents, or sensitive personal data.<\/li>\n\n\n\n<li><strong>Perform BEC attacks:<\/strong> Send fake invoices or payment instructions to clients, vendors, or internal finance teams.<\/li>\n\n\n\n<li><strong>Pivot to other accounts:<\/strong> Use the email inbox for password resets on other accounts (shopping, banking, cloud services).<\/li>\n\n\n\n<li><strong>Spread the phishing:<\/strong> Use the compromised account to send additional phishing emails to contacts, leveraging trust to amplify reach.<\/li>\n\n\n\n<li><strong>Cover tracks:<\/strong> Modify email rules (e.g., forwarding, auto-delete) to intercept or hide communications related to discovery and remediation.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Step 8 \u2014 Monetization and Persistence<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Monetization strategies include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Direct fraud:<\/strong> Use accounts to request fraudulent wire transfers, access stored payment methods, or siphon funds.<\/li>\n\n\n\n<li><strong>Credential resale:<\/strong> Sell validated email\/password combos (sometimes with attached metadata) on illicit marketplaces.<\/li>\n\n\n\n<li><strong>Long-term espionage:<\/strong> For targeted campaigns against organizations, attackers may remain dormant to monitor communications and harvest strategic information for corporate espionage.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Step 9 \u2014 Cleanup &amp; Reuse<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Attackers often reuse successful infrastructure. Domains or kits that work are rotated through to avoid detection and ensure a steady stream of harvested credentials.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Understanding each step shows where detection, prevention, and rapid response can break the chain \u2014 from email filtering to careful inspection of links, to immediate credential resets if a compromise occurs.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Signs You\u2019ve Been Targeted or Compromised<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Detecting whether you were targeted or compromised requires checking for a number of indicators:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>You clicked a suspicious link<\/strong> in an unsolicited email and entered credentials.<\/li>\n\n\n\n<li><strong>Unrecognized logins<\/strong> show up in your email\u2019s recent activity (unknown IP addresses, unusual locations).<\/li>\n\n\n\n<li><strong>Out-of-office rules or forwarding addresses<\/strong> have been created without your consent.<\/li>\n\n\n\n<li><strong>Sent folder activity<\/strong> shows messages you didn\u2019t send (phishers often use your account to propagate scams).<\/li>\n\n\n\n<li><strong>Password reset requests<\/strong> or notifications from other services that you didn\u2019t request.<\/li>\n\n\n\n<li><strong>Contacts report phishing<\/strong> or receiving strange emails appearing to be from you.<\/li>\n\n\n\n<li><strong>Files or emails are missing<\/strong> or attachments were downloaded without authorization.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">If you observe any of these, follow the recovery steps listed below immediately.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What To Do If You Have Fallen Victim (Actionable, Numbered Steps)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Time is the most critical factor after a potential compromise. The sooner you act, the less damage attackers can do. Follow these steps carefully and in order.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1. Disconnect from the Internet (if possible)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If you believe malware may have been installed (for example, you clicked attachments or downloaded software from the phishing page), temporarily disconnect the affected device from the internet to reduce the risk of ongoing data exfiltration or remote control.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. Change Your Email Password Immediately<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Open a browser and navigate directly to your email provider\u2019s official site by typing the URL yourself (do not use stored links or email links).<\/li>\n\n\n\n<li>Change your password to a new, strong, unique password \u2014 at least 12 characters including upper\/lowercase letters, numbers, and symbols, or use a passphrase.<\/li>\n\n\n\n<li>Do this on a trusted device that you believe is not compromised.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3. Enable or Reconfigure Two-Factor Authentication (2FA)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>If you haven\u2019t enabled 2FA, do so now. Prefer authenticator apps (Google Authenticator, Authy, Microsoft Authenticator) or hardware keys (YubiKey) over SMS-based codes.<\/li>\n\n\n\n<li>If 2FA was enabled but you provided a code to the attacker, reset 2FA methods and inspect backup codes \u2014 revoke and regenerate backup codes and update your authentication devices.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">4. Review and Revoke Active Sessions and App Access<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>In your email account settings, review recent login sessions. Sign out of all other devices\/sessions.<\/li>\n\n\n\n<li>Go to \u201cConnected apps\u201d or \u201cThird-party access\u201d and remove any unknown or suspicious applications and tokens.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">5. Check and Remove Unauthorized Mail Rules or Forwarding<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Inspect your filters and forwarding rules. Attackers commonly set rules to auto-forward incoming mail to external addresses so they can monitor communications without maintaining direct access.<\/li>\n\n\n\n<li>Delete any unfamiliar rules and temporary auto-responses.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6. Inform Your Contacts<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Send a notification to colleagues, friends, and family warning them not to open any suspicious messages coming from your address.<\/li>\n\n\n\n<li>If your email is used for business, notify IT or your security team immediately so they can take organization-level protections.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7. Check for Financial and Account Compromise<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Review bank and credit card statements for unauthorized charges.<\/li>\n\n\n\n<li>For accounts linked to your email for password recovery (shopping, social media, financial accounts), change passwords and enable 2FA.<\/li>\n\n\n\n<li>Contact your bank immediately if there are any signs of fraudulent activity.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">8. Scan and Clean Your Devices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Run a full virus and anti-malware scan with a reputable product.<\/li>\n\n\n\n<li>If the device shows evidence of persistent infection (rootkits, remote access tools), consider wiping and reinstalling the OS from a clean image. Backup important files first, but ensure those backups are clean.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9. Report the Phishing Incident<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use your email provider\u2019s \u201cReport phishing\u201d or \u201cReport spam\u201d function to help block the sending domain.<\/li>\n\n\n\n<li>Forward the phishing email to anti-phishing organizations (e.g., <a>reportphishing@apwg.org<\/a>).<\/li>\n\n\n\n<li>In the U.S., file a report with the FTC and consider reporting to local law enforcement if financial loss occurred.<\/li>\n\n\n\n<li>In the U.K., forward phishing emails to <a>report@phishing.gov.uk<\/a>. In the EU, report to your national cybercrime center.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">10. Consider Credit Monitoring or Freezing<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>If personal identity or financial data may have been accessed (attachments with SSNs, tax documents), consider placing a fraud alert or credit freeze and enrolling in credit monitoring.<\/li>\n<\/ul>\n\n\n<h2>Is Your Device Infected? Run a Free Malware Scan<\/h2>\n\n<p>Slow performance, constant pop-ups, or strange behavior? These are classic signs of a malware infection. A quick way to check is to scan your device with <strong>Malwarebytes Free<\/strong>, one of the most trusted malware removal tools available. If you only visited a scam page and didn&#8217;t download or install anything, this scan is optional.<\/p>\n\n<p>The free version detects and removes the most common threats, including:<\/p>\n\n<ul>\n<li><strong>Adware<\/strong> \u2014 the cause of those annoying pop-ups<\/li>\n<li><strong>Browser hijackers<\/strong> \u2014 unwanted redirects and changed homepages<\/li>\n<li><strong>Trojans and spyware<\/strong> \u2014 hidden programs stealing your data<\/li>\n<li><strong>Potentially unwanted programs (PUPs)<\/strong> \u2014 software you never asked for<\/li>\n<\/ul>\n\n<p>\ud83d\udc49 <strong>Select your device below<\/strong> \u2014 Windows, Mac, or Android \u2014 then follow the simple steps to download Malwarebytes, scan your system, and remove any threats it finds. The scan usually takes 5 to 20 minutes.<\/p>\n\n<div class=\"su-tabs mwtcui-tabs \" data-mwt-tabs data-active=\"1\" data-anchor-in-url=\"no\"><div class=\"su-tabs-nav\" role=\"tablist\" aria-label=\"Instructions\"><button type=\"button\" class=\"\" role=\"tab\" id=\"mwtcui-tabs-1-0-tab\" aria-controls=\"mwtcui-tabs-1-0\" aria-selected=\"true\" tabindex=\"0\" data-anchor=\"\">Malwarebytes for Windows<\/button><button type=\"button\" class=\"\" role=\"tab\" id=\"mwtcui-tabs-1-1-tab\" aria-controls=\"mwtcui-tabs-1-1\" aria-selected=\"false\" tabindex=\"-1\" data-anchor=\"\">Malwarebytes for Mac<\/button><button type=\"button\" class=\"\" role=\"tab\" id=\"mwtcui-tabs-1-2-tab\" aria-controls=\"mwtcui-tabs-1-2\" aria-selected=\"false\" tabindex=\"-1\" data-anchor=\"\">Malwarebytes for Android<\/button><\/div><div class=\"su-tabs-panes\"><div class=\"su-tabs-pane mwtcui-tab-panel \" id=\"mwtcui-tabs-1-0\" role=\"tabpanel\" aria-labelledby=\"mwtcui-tabs-1-0-tab\" data-title=\"Malwarebytes for Windows\" data-anchor=\"\">\n\n<h3 id=\"windowsh3\" class=\"toch3\">Run a Malware Scan with Malwarebytes for Windows<\/h3>\n\n\n<p class=\"wp-block-paragraph\"><strong>Malwarebytes<\/strong> is one of the most popular and trusted anti-malware tools for Windows \u2014 and it&#8217;s completely free for removing infections. It catches threats that many antivirus programs miss, including adware, browser hijackers, and trojans. Follow the steps below to scan your PC and remove what Malwarebytes finds.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><p class=\"mwt_quick_overview\">Download Malwarebytes<\/p> <p>Click the button below to download the latest version of <strong>Malwarebytes for Windows<\/strong> from the official source. The free version is all you need \u2014 it will scan your computer and remove adware, browser hijackers, and other malicious software at no cost.<\/p> <div class=\"mwt_download_box mwt_cta\"><div class=\"mwt_cta_head\"><img loading=\"lazy\" decoding=\"async\" class=\"mwt_product_icon_logo\" width=\"40\" height=\"40\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2018\/06\/Malwarebytes-LOGO.png\" alt=\"Malwarebytes logo\" title=\"\"><div><span class=\"mwt_cta_title\">Malwarebytes Free for Windows<\/span><span class=\"mwt_cta_sub\">Scans and removes malware at no cost<\/span><\/div><\/div><a class=\"mwt_cta_btn\" data-google-vignette=\"false\" href=\"https:\/\/malwaretips.com\/downloads\/MBSetup-076886.076886-consumer.exe\" onclick=\"window.open('https:\/\/malwaretips.com\/get\/malwarebytes-free','_blank','noopener');\">Download Malwarebytes<\/a><span class=\"mwt_cta_note\">Official installer for Windows 11 and 10. Your download starts right away.<\/span><a class=\"mwt_cta_more\" data-google-vignette=\"false\" href=\"https:\/\/malwaretips.com\/get\/malwarebytes-premium-box\" target=\"_blank\" rel=\"noopener sponsored\">Want real-time protection? See Malwarebytes Premium<\/a><\/div><\/li>\n\n\n\n<li> <p class=\"mwt_quick_overview\">Install Malwarebytes<\/p>\n\n<p>When the download finishes, open your <strong>Downloads<\/strong> folder and <strong>double-click the MBSetup file<\/strong>. If Windows shows a <strong>User Account Control<\/strong> pop-up, click &#8220;<em>Yes<\/em>&#8221; to allow the installation.<\/p>\n\n <figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"975\" height=\"500\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2024\/05\/MBAM1.jpg\" alt=\"Windows File Explorer Downloads folder with the Malwarebytes setup file highlighted\" class=\"wp-image-285934\" title=\"\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2024\/05\/MBAM1.jpg 975w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2024\/05\/MBAM1-300x154.jpg 300w\" sizes=\"auto, (max-width: 975px) 100vw, 975px\" \/><\/figure> \n\n \n  \n\n<\/li>\n\n\n\n<li><p class=\"mwt_quick_overview\">Follow the On-Screen Prompts to Install Malwarebytes<\/p> \n\n<p>The setup wizard will walk you through a few quick screens:<\/p>\n\n<ul>\n \n  <li>\n    <p>Choose where you&#8217;re installing the program \u2014 &#8220;<strong>Personal Computer<\/strong>&#8221; or &#8220;<strong>Work Computer<\/strong>&#8221; \u2014 then click <strong>Next<\/strong>.<\/p>\n    <figure class=\"wp-block-image size-full\">\n      <img loading=\"lazy\" decoding=\"async\" width=\"737\" height=\"500\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2024\/05\/MBAM3-1.jpg\" alt=\"Malwarebytes Setup asking you to choose a protection type, with Personal selected\" class=\"wp-image-285953\" title=\"\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2024\/05\/MBAM3-1.jpg 737w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2024\/05\/MBAM3-1-300x204.jpg 300w\" sizes=\"auto, (max-width: 737px) 100vw, 737px\" \/>\n    <\/figure>\n  <\/li>\n  <li>\n    <p>Malwarebytes will now install on your device. This usually takes under a minute.<\/p>\n    <figure class=\"wp-block-image size-full\">\n      <img loading=\"lazy\" decoding=\"async\" width=\"759\" height=\"500\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2024\/05\/MBAM4.jpg\" alt=\"Malwarebytes Setup installing the program, with the progress at 92 percent\" class=\"wp-image-285937\" title=\"\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2024\/05\/MBAM4.jpg 759w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2024\/05\/MBAM4-300x198.jpg 300w\" sizes=\"auto, (max-width: 759px) 100vw, 759px\" \/>\n    <\/figure>\n  <\/li>\n  <li>\n    <p>When installation is complete, the &#8220;<strong>Welcome to Malwarebytes<\/strong>&#8221; screen will open automatically.<\/p>\n    <figure class=\"wp-block-image size-full\">\n      <img loading=\"lazy\" decoding=\"async\" width=\"705\" height=\"500\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2024\/05\/MBAM6-1.jpg\" alt=\"Welcome to Malwarebytes screen with the Get started button highlighted\" class=\"wp-image-285951\" title=\"\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2024\/05\/MBAM6-1.jpg 705w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2024\/05\/MBAM6-1-300x213.jpg 300w\" sizes=\"auto, (max-width: 705px) 100vw, 705px\" \/>\n    <\/figure>\n  <\/li>\n  <li>\n    <p>On the final screen, click <strong>Open Malwarebytes<\/strong> to launch the program.<\/p>\n    <figure class=\"wp-block-image size-full\">\n      <img loading=\"lazy\" decoding=\"async\" width=\"749\" height=\"500\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2024\/05\/MBAM5-1.jpg\" alt=\"Malwarebytes Setup success screen with the Open Malwarebytes button highlighted\" class=\"wp-image-285952\" title=\"\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2024\/05\/MBAM5-1.jpg 749w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2024\/05\/MBAM5-1-300x200.jpg 300w\" sizes=\"auto, (max-width: 749px) 100vw, 749px\" \/>\n    <\/figure>\n  <\/li>\n<\/ul>\n\n<\/li>\n\n\n\n<li><p class=\"mwt_quick_overview\">Optional: Check for rootkits with a Custom Scan<\/p>\n<p>You don&#8217;t need to change any settings for a normal scan. The standard <strong>Threat Scan<\/strong> in the next step is enough for most problems, so you can go straight to it.<\/p>\n<p>If you also want to check for rootkits, use a Custom Scan. In current versions of Malwarebytes, rootkit scanning is only available there:<\/p>\n<ol>\n<li>On the <strong>Scanner<\/strong> tile, click the three-dot menu and select <strong>Advanced Scan<\/strong>.<\/li>\n<li>Choose <strong>Custom Scan<\/strong>. In its options, check <strong>Scan for rootkits<\/strong>.<\/li>\n<li>Select your system drive (usually <strong>C:\\<\/strong>) as the location to scan, then start the scan. It takes longer than a Threat Scan.<\/li>\n<li>When it finishes, review and quarantine the results as described in the steps below.<\/li>\n<\/ol>\n<p>Rootkit scanning isn&#8217;t available on Windows devices with ARM processors.<\/p><\/li>\n\n\n\n<li><p class=\"mwt_quick_overview\">Start the Scan<\/p> <p>Click the blue <strong>Scan<\/strong> button. Malwarebytes will automatically update its virus database and start checking your computer for malware.<\/p><figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"849\" height=\"600\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2024\/05\/MBAM10.jpg\" alt=\"Malwarebytes dashboard with the Scan button on the Scanner tile highlighted\" class=\"wp-image-285941\" title=\"\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2024\/05\/MBAM10.jpg 849w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2024\/05\/MBAM10-300x212.jpg 300w\" sizes=\"auto, (max-width: 849px) 100vw, 849px\" \/><\/figure><\/li>\n\n\n\n<li>\n<p class=\"mwt_quick_overview\">Wait for the Scan to Finish<\/p>\n<p>The scan checks your entire system for browser hijackers and other malicious programs, so it can take 5 to 20 minutes depending on your computer. Feel free to do something else \u2014 just check back occasionally to see the progress.<\/p>\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"842\" height=\"600\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2024\/05\/MBAM11.jpg\" alt=\"Malwarebytes Threat Scan in progress, listing the scan stages and the number of items scanned\" class=\"wp-image-285944\" title=\"\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2024\/05\/MBAM11.jpg 842w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2024\/05\/MBAM11-300x214.jpg 300w\" sizes=\"auto, (max-width: 842px) 100vw, 842px\" \/><\/figure><\/li>\n\n\n\n<li>\n<p class=\"mwt_quick_overview\">Quarantine the Detected Threats<\/p>\n<p>When the scan is done, you&#8217;ll see a list of everything Malwarebytes found \u2014 malware, adware, and potentially unwanted programs. Click the &#8220;<strong>Quarantine<\/strong>&#8221; button to remove all of them at once.<\/p>\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"844\" height=\"600\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2024\/05\/MBAM12.jpg\" alt=\"Malwarebytes Threat Scan results listing detected potentially unwanted programs, with the Quarantine button highlighted\" class=\"wp-image-285945\" title=\"\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2024\/05\/MBAM12.jpg 844w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2024\/05\/MBAM12-300x213.jpg 300w\" sizes=\"auto, (max-width: 844px) 100vw, 844px\" \/><\/figure>\n\n<p>Malwarebytes will now remove the malicious files and registry entries and move them safely into quarantine.<\/p>\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"842\" height=\"600\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2024\/05\/MBAM13.jpg\" alt=\"Malwarebytes moving the selected detections to quarantine\" class=\"wp-image-285946\" title=\"\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2024\/05\/MBAM13.jpg 842w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2024\/05\/MBAM13-300x214.jpg 300w\" sizes=\"auto, (max-width: 842px) 100vw, 842px\" \/><\/figure><\/li>\n\n\n\n<li>\n  <p class=\"mwt_quick_overview\">Restart Your Computer<\/p>\n  <p>Some threats can only be fully removed after a reboot. If Malwarebytes asks you to restart, click <strong>Yes<\/strong>. Once you&#8217;re logged back in, Malwarebytes has finished removing the threats it found.<\/p>\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"844\" height=\"600\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2024\/05\/MBAM14.jpg\" alt=\"Malwarebytes message asking to restart the computer to finish the removal, with the Yes button highlighted\" class=\"wp-image-285947\" title=\"\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2024\/05\/MBAM14.jpg 844w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2024\/05\/MBAM14-300x213.jpg 300w\" sizes=\"auto, (max-width: 844px) 100vw, 844px\" \/><\/figure><\/li>\n<\/ol>\n\n\n<p>When the scan is done, check whether the problems you noticed have stopped. If they continue, see the options below.<\/p>\n\n\n<div class=\"mwt_download_box mwt_cta mwt_protect\"><div class=\"mwt_cta_head\"><img loading=\"lazy\" decoding=\"async\" class=\"mwt_product_icon_logo\" width=\"40\" height=\"40\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2018\/06\/Malwarebytes-LOGO.png\" alt=\"Malwarebytes logo\" title=\"\"><div><span class=\"mwt_cta_title\">Keep your PC protected<\/span><span class=\"mwt_cta_sub\">Stop the next infection before it starts<\/span><\/div><\/div><span class=\"mwt_protect_text\">If your antivirus let this threat through, it may not be enough on its own. Malwarebytes Premium adds real-time protection that blocks malware, ransomware, and malicious websites before they can infect your computer.<\/span><a class=\"mwt_cta_btn\" data-google-vignette=\"false\" href=\"https:\/\/malwaretips.com\/get\/malwarebytes-premium-final\" target=\"_blank\" rel=\"noopener sponsored\">See Malwarebytes Premium<\/a><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">If you are still having problems with your computer after completing these instructions, then please follow one of the steps:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Run a computer scan with <strong><a href=\"https:\/\/malwaretips.com\/get\/esetonlinescanner\" target=\"_blank\" rel=\"noopener sponsored\" data-google-vignette=\"false\">ESET Online Scanner<\/a><\/strong><\/li><li>Ask for help in our <strong><a title=\"Malware Removal Assistance for Windows\" href=\"https:\/\/malwaretips.com\/forums\/windows-malware-removal-help-support.10\/\" target=\"_blank\" rel=\"noopener noreferrer\">Windows Malware Removal Help &amp; Support<\/a><\/strong> forum.<\/li><\/ul>\n\n\n<\/div><div class=\"su-tabs-pane mwtcui-tab-panel \" id=\"mwtcui-tabs-1-1\" role=\"tabpanel\" aria-labelledby=\"mwtcui-tabs-1-1-tab\" data-title=\"Malwarebytes for Mac\" data-anchor=\"\">\n\n<h3 id=\"mach3\" class=\"toch3\">Run a Malware Scan with Malwarebytes for Mac<\/h3>\n\n\n<p class=\"wp-block-paragraph\"><strong>Malwarebytes for Mac<\/strong> is a free on-demand scanner that removes the malware other security software tends to miss \u2014 adware, browser hijackers, and unwanted programs included. Cleaning an infected Mac with Malwarebytes has always been completely free, and it&#8217;s our go-to recommendation. Follow the steps below to scan your Mac and remove what Malwarebytes finds.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p class=\"mwt_quick_overview\">Download Malwarebytes for Mac<\/p>\n<p>Click the button below to download the latest version of <strong>Malwarebytes for Mac<\/strong>.<\/p>\n<div class=\"mwt_download_box mwt_cta\"><div class=\"mwt_cta_head\"><img loading=\"lazy\" decoding=\"async\" class=\"mwt_product_icon_logo\" width=\"40\" height=\"40\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2018\/06\/Malwarebytes-LOGO.png\" alt=\"Malwarebytes logo\" title=\"\"><div><span class=\"mwt_cta_title\">Malwarebytes Free for Mac<\/span><span class=\"mwt_cta_sub\">Scans and removes malware at no cost<\/span><\/div><\/div><a class=\"mwt_cta_btn\" data-google-vignette=\"false\" href=\"https:\/\/malwaretips.com\/download-malwarebytes-for-mac\" onclick=\"window.open('https:\/\/malwaretips.com\/get\/malwarebytes-mac','_blank','noopener');\">Download Malwarebytes<\/a><span class=\"mwt_cta_note\">Official installer for macOS. Your download starts right away.<\/span><a class=\"mwt_cta_more\" data-google-vignette=\"false\" href=\"https:\/\/malwaretips.com\/get\/malwarebytes-mac-premium\" target=\"_blank\" rel=\"noopener sponsored\">Want real-time protection? See Malwarebytes Premium<\/a><\/div>\n<\/li>\n\n\n\n<li>\n<p class=\"mwt_quick_overview\">Open the Malwarebytes setup file<\/p>\n<p>When the download finishes, open your <em>Downloads<\/em> folder and <strong>double-click the setup file<\/strong> to begin the installation.<\/p>\n<figure><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-98734 alignnone\" title=\"Double-click on setup file to install Malwarebytes\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2019\/11\/Malwarebytes-Mac-Installer.jpg\" alt=\"Double-click on setup file to install Malwarebytes\" width=\"750\" height=\"424\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2019\/11\/Malwarebytes-Mac-Installer.jpg 750w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2019\/11\/Malwarebytes-Mac-Installer-300x170.jpg 300w\" sizes=\"auto, (max-width: 750px) 100vw, 750px\" \/><\/figure><p><\/p>\n<\/li>\n\n\n\n<li>\n<p class=\"mwt_quick_overview\">Follow the On-Screen Prompts to Install Malwarebytes<\/p>\n<p>The <em>Malwarebytes for Mac Installer<\/em> will guide you through a few quick screens. Click &#8220;<strong>Continue<\/strong>&#8221; and keep following the prompts until the installation completes.<\/p>\n<figure><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-98735 alignnone\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2019\/11\/Malwarebytes-Mac-Installer-Step-1.jpg\" alt=\"Click Continue to install Malwarebytes for Mac\" width=\"750\" height=\"532\" title=\"\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2019\/11\/Malwarebytes-Mac-Installer-Step-1.jpg 750w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2019\/11\/Malwarebytes-Mac-Installer-Step-1-300x213.jpg 300w\" sizes=\"auto, (max-width: 750px) 100vw, 750px\" \/><\/figure><p><\/p>\n<figure><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-98736 alignnone\" title=\"Click again on Continue to install Malwarebytes for Mac for Mac\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2019\/11\/Malwarebytes-Mac-Installer-Step-2.jpg\" alt=\"Click again on Continue to install Malwarebytes for Mac\" width=\"750\" height=\"531\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2019\/11\/Malwarebytes-Mac-Installer-Step-2.jpg 750w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2019\/11\/Malwarebytes-Mac-Installer-Step-2-300x212.jpg 300w\" sizes=\"auto, (max-width: 750px) 100vw, 750px\" \/><\/figure><p><\/p>\n<figure><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-98737 alignnone\" title=\"Click Install to install Malwarebytes on Mac\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2019\/11\/Malwarebytes-Mac-Installer-Step-4.jpg\" alt=\"Click Install to install Malwarebytes on Mac\" width=\"750\" height=\"531\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2019\/11\/Malwarebytes-Mac-Installer-Step-4.jpg 750w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2019\/11\/Malwarebytes-Mac-Installer-Step-4-300x212.jpg 300w\" sizes=\"auto, (max-width: 750px) 100vw, 750px\" \/><\/figure><p><\/p>\n<p>When the installation is complete, Malwarebytes opens to the <em>Welcome to Malwarebytes<\/em> screen. Click &#8220;<strong>Get started<\/strong>&#8220;.<\/p>\n<p>Malwarebytes needs <strong>Full Disk Access<\/strong> to check your whole Mac. When it asks, open <strong>System Settings &gt; Privacy &amp; Security &gt; Full Disk Access<\/strong>, turn on <strong>Malwarebytes<\/strong> (it may be listed as Malwarebytes Protection), and confirm with your password or Touch ID. Then return to Malwarebytes. On macOS Monterey and earlier, this setting is in System Preferences &gt; Security &amp; Privacy &gt; Privacy.<\/p>\n<\/li>\n\n\n\n<li>\n<p class=\"mwt_quick_overview\">Select &#8220;Personal Computer&#8221; or &#8220;Work Computer&#8221;<\/p>\n<p>Malwarebytes will ask what type of computer you&#8217;re installing it on. Click either <strong>Personal Computer<\/strong> or <strong>Work Computer<\/strong>, whichever applies.<br \/><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-98740 alignnone\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2019\/11\/Malwarebytes-Mac-Select-Personal-Computer.jpg\" alt=\"Select Personal Computer or Work Computer mac\" width=\"750\" height=\"537\" title=\"\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2019\/11\/Malwarebytes-Mac-Select-Personal-Computer.jpg 750w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2019\/11\/Malwarebytes-Mac-Select-Personal-Computer-300x215.jpg 300w\" sizes=\"auto, (max-width: 750px) 100vw, 750px\" \/><\/p>\n<\/li>\n\n\n\n<li>\n<p class=\"mwt_quick_overview\">Start the Scan<\/p>\n<p>Click the &#8220;<strong>Scan<\/strong>&#8221; button. Malwarebytes will automatically update its detection database and begin checking your Mac for malware.<br \/><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-98733 alignnone\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2019\/11\/Malwarebytes-Mac-Click-Scan.jpg\" alt=\"Click on Scan button to start a system scan Mac\" width=\"750\" height=\"538\" title=\"\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2019\/11\/Malwarebytes-Mac-Click-Scan.jpg 750w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2019\/11\/Malwarebytes-Mac-Click-Scan-300x215.jpg 300w\" sizes=\"auto, (max-width: 750px) 100vw, 750px\" \/><\/p>\n<\/li>\n\n\n\n<li>\n<p class=\"mwt_quick_overview\">Wait for the Scan to Finish<\/p>\n<p>Malwarebytes will scan your Mac for adware, browser hijackers, and other malicious programs. This can take a few minutes, so feel free to do something else \u2014 just check back occasionally to see the progress.<br \/><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-98739 alignnone\" title=\"Wait for Malwarebytes for Mac to scan your computer\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2019\/11\/Malwarebytes-Mac-Scanning-for-malware.jpg\" alt=\"Wait for Malwarebytes for Mac to scan for malware\" width=\"750\" height=\"536\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2019\/11\/Malwarebytes-Mac-Scanning-for-malware.jpg 750w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2019\/11\/Malwarebytes-Mac-Scanning-for-malware-300x214.jpg 300w\" sizes=\"auto, (max-width: 750px) 100vw, 750px\" \/><\/p>\n<\/li>\n\n\n\n<li>\n<p class=\"mwt_quick_overview\">Quarantine the Detected Threats<\/p>\n<p>When the scan is done, you&#8217;ll see a list of everything Malwarebytes found. Click the &#8220;<strong>Quarantine<\/strong>&#8221; button to remove all the threats at once.<br \/><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-98732 alignnone\" title=\"Review the malicious programs and click on Quarantine\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2019\/11\/Malwarebytes-Mac-Click-Confirm.jpg\" alt=\"Review the malicious programs and click on Quarantine to remove malware\" width=\"750\" height=\"538\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2019\/11\/Malwarebytes-Mac-Click-Confirm.jpg 750w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2019\/11\/Malwarebytes-Mac-Click-Confirm-300x215.jpg 300w\" sizes=\"auto, (max-width: 750px) 100vw, 750px\" \/><\/p>\n<\/li>\n\n\n\n<li> <p class=\"mwt_quick_overview\">Restart Your Mac<\/p> <p>Malwarebytes will now remove all the malicious files it found. Some threats can only be fully removed after a reboot \u2014 if Malwarebytes asks you to restart, allow it. Once you&#8217;re logged back in, check whether the problems you noticed have stopped. If they come back, save the scan report and ask for help in our forum.<br \/><img loading=\"lazy\" decoding=\"async\" width=\"750\" height=\"536\" class=\"size-full wp-image-98738 alignnone\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2019\/11\/Malwarebytes-Mac-Restart.jpg\" alt=\"Malwarebytes For Mac requesting to restart computer\" title=\"\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2019\/11\/Malwarebytes-Mac-Restart.jpg 750w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2019\/11\/Malwarebytes-Mac-Restart-300x214.jpg 300w\" sizes=\"auto, (max-width: 750px) 100vw, 750px\" \/><br \/><\/p> <\/li>\n<\/ol>\n\n\n<p>If the problems you noticed continue after the scan, see the options below.<\/p>\n\n\n<div class=\"mwt_download_box mwt_cta mwt_protect\"><div class=\"mwt_cta_head\"><img loading=\"lazy\" decoding=\"async\" class=\"mwt_product_icon_logo\" width=\"40\" height=\"40\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2018\/06\/Malwarebytes-LOGO.png\" alt=\"Malwarebytes logo\" title=\"\"><div><span class=\"mwt_cta_title\">Keep your Mac protected<\/span><span class=\"mwt_cta_sub\">Stop the next infection before it starts<\/span><\/div><\/div><span class=\"mwt_protect_text\">If your Mac got infected, its built-in protection may not be enough on its own. Malwarebytes Premium for Mac adds real-time protection that blocks malware and adware before they can infect your Mac.<\/span><a class=\"mwt_cta_btn\" data-google-vignette=\"false\" href=\"https:\/\/malwaretips.com\/get\/malwarebytes-mac-premium\" target=\"_blank\" rel=\"noopener sponsored\">See Malwarebytes Premium<\/a><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">If you are still experiencing problems while trying to remove a malicious program from your computer, please ask for help in our <strong><a title=\"Mac Malware Removal Help &amp; Support\" href=\"https:\/\/malwaretips.com\/forums\/mac-malware-removal-help-support.183\/\" target=\"_blank\" rel=\"noopener noreferrer\">Mac Malware Removal Help &amp; Support<\/a><\/strong> forum.<\/p>\n\n\n<\/div><div class=\"su-tabs-pane mwtcui-tab-panel \" id=\"mwtcui-tabs-1-2\" role=\"tabpanel\" aria-labelledby=\"mwtcui-tabs-1-2-tab\" data-title=\"Malwarebytes for Android\" data-anchor=\"\">\n\n<h3 id=\"androidh3\" class=\"toch3\">Run a Malware Scan with Malwarebytes for Android<\/h3>\n\n<p>Malwarebytes for Android scans your phone or tablet for malware, adware, and potentially unwanted apps. The free version scans only when you start a scan. Real-time protection, which checks apps automatically, is part of the paid Premium version.<\/p>\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p class=\"mwt_quick_overview\">Download Malwarebytes for Android.<\/p>\n<p>You can download <strong>Malwarebytes for Android<\/strong> by clicking the link below.<\/p>\n<div class=\"mwt_download_box mwt_cta\"><div class=\"mwt_cta_head\"><img loading=\"lazy\" decoding=\"async\" class=\"mwt_product_icon_logo\" width=\"40\" height=\"40\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2018\/06\/Malwarebytes-LOGO.png\" alt=\"Malwarebytes for Android logo\" title=\"\"><div><span class=\"mwt_cta_title\">Malwarebytes for Android<\/span><span class=\"mwt_cta_sub\">Scans your phone and removes malware at no cost<\/span><\/div><\/div><a class=\"mwt_cta_btn\" data-google-vignette=\"false\" href=\"https:\/\/play.google.com\/store\/apps\/details?id=org.malwarebytes.antimalware\" target=\"_blank\" rel=\"noopener\">Get Malwarebytes for Android<\/a><span class=\"mwt_cta_note\">Opens Google Play in a new tab.<\/span><a class=\"mwt_cta_more\" data-google-vignette=\"false\" href=\"https:\/\/malwaretips.com\/get\/malwarebytes-android\" target=\"_blank\" rel=\"noopener sponsored\">Want real-time protection? See Malwarebytes Premium for Android<\/a><\/div>\n<\/li>\n\n\n\n<li>\n<p class=\"mwt_quick_overview\">Install Malwarebytes for Android on your phone.<\/p>\n<p>In the Google Play Store, tap &#8220;<strong>Install<\/strong>&#8221; to install Malwarebytes for Android on your device.<\/p>\n<figure><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-106940\" title=\"Tap Install to install Malwarebytes for Android\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Google-Play-App.jpg\" alt=\"Tap Install to install Malwarebytes for Android\" width=\"292\" height=\"580\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Google-Play-App.jpg 292w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Google-Play-App-151x300.jpg 151w\" sizes=\"auto, (max-width: 292px) 100vw, 292px\" \/><\/figure><p><\/p>\n<p>When the installation process has finished, tap &#8220;<strong>Open<\/strong>&#8221; to begin using Malwarebytes for Android. You can also open Malwarebytes by tapping on its icon in your phone menu or home screen.<br \/><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-106941\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Open-App.jpg\" alt=\"Malwarebytes for Android - Open App\" width=\"292\" height=\"578\" title=\"\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Open-App.jpg 292w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Open-App-152x300.jpg 152w\" sizes=\"auto, (max-width: 292px) 100vw, 292px\" \/><\/p>\n<\/li>\n\n\n\n<li>\n<p class=\"mwt_quick_overview\">Follow the on-screen prompts to complete the setup process<\/p>\n<p>When Malwarebytes opens, it walks you through a short setup. Tap <strong>Get started<\/strong> and follow the prompts. If you see an offer for a trial or a paid plan, read it before you accept. You can skip it and keep using the free scanner.<\/p>\n<p>Malwarebytes will ask for permission to access the files on your phone so it can scan them. Tap <strong>Allow<\/strong>, or turn on the permission in the Android screen that opens, then return to Malwarebytes.<\/p>\n<\/li>\n\n\n\n<li>\n<p class=\"mwt_quick_overview\">Run a scan with Malwarebytes for Android<\/p>\n<p>On the main screen, tap <strong>Scan now<\/strong>. In some versions, you open the menu, tap <strong>Scanner<\/strong>, and then tap <strong>Run a scan<\/strong>.<\/p>\n<\/li>\n\n\n\n<li>\n<p class=\"mwt_quick_overview\">Wait for the Malwarebytes scan to complete.<\/p>\n<p>Malwarebytes will now start scanning your phone for adware and other malicious apps. This process can take a few minutes, so we suggest you do something else and periodically check on the status of the scan to see when it is finished.<br \/><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-106943\" title=\"Malwarebytes scanning phone for malware\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Scanning-for-Malware.jpg\" alt=\"Malwarebytes scanning Android for Vmalware\" width=\"292\" height=\"579\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Scanning-for-Malware.jpg 292w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Scanning-for-Malware-151x300.jpg 151w\" sizes=\"auto, (max-width: 292px) 100vw, 292px\" \/><\/p>\n<\/li>\n\n\n\n<li>\n<p class=\"mwt_quick_overview\">Remove the detected apps.<\/p>\n<p>When the scan has been completed, you will see a list of the threats that Malwarebytes for Android has detected. Next to each detected item, tap the menu icon (three dots), then choose to uninstall the app or delete the file. Android then asks you to confirm. Tap <strong>OK<\/strong> or <strong>Uninstall<\/strong> to remove the app.<\/p>\n<\/li>\n\n\n\n<li>\n<p class=\"mwt_quick_overview\">Restart your phone.<\/p>\n<p>When the detected apps are removed, restart your phone if Malwarebytes asks you to. Then check whether the problems you noticed have stopped.<\/p>\n<\/li>\n<\/ol>\n\n\n<hr \/>\n\n<p>If the problems you noticed continue after the scan, see the options below.<\/p>\n\n\n<div class=\"mwt_download_box mwt_cta mwt_protect\"><div class=\"mwt_cta_head\"><img loading=\"lazy\" decoding=\"async\" class=\"mwt_product_icon_logo\" width=\"40\" height=\"40\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2018\/06\/Malwarebytes-LOGO.png\" alt=\"Malwarebytes logo\" title=\"\"><div><span class=\"mwt_cta_title\">Keep your phone protected<\/span><span class=\"mwt_cta_sub\">Stop the next infection before it starts<\/span><\/div><\/div><span class=\"mwt_protect_text\">Malwarebytes for Android Premium adds real-time protection that blocks malicious apps and scam links before they can harm your phone.<\/span><a class=\"mwt_cta_btn\" data-google-vignette=\"false\" href=\"https:\/\/malwaretips.com\/get\/malwarebytes-android\" target=\"_blank\" rel=\"noopener sponsored\">See Malwarebytes for Android<\/a><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">If you are still having problems with your phone after completing these instructions, then please follow one of the steps:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Ask for help in our <strong><a title=\"Mobile Malware Removal Help &amp; Support\" href=\"https:\/\/malwaretips.com\/forums\/mobile-malware-removal-help-support.165\/\" target=\"_blank\" rel=\"noopener noreferrer\">Mobile Malware Removal Help &amp; Support<\/a><\/strong> forum.<\/li><li>Only as a last resort, reset your phone to factory settings. Read the warning below first.<\/li><\/ul>\n\n\n\n<div class=\"mt_noter\"><strong>A factory reset erases everything on your phone.<\/strong> Your apps, photos, files, and settings are deleted, so use it only if the problem continues after the steps above and after you&#8217;ve asked for help. Before you reset:<ul><li>Back up your photos, videos, files, and messages, for example to your Google account or a computer.<\/li><li>Make sure you know your Google account email and password. The phone asks for them after the reset. If you changed the password recently, Google recommends waiting 24 hours before you reset.<\/li><li>On a Samsung phone, also make sure you know your Samsung account password.<\/li><li>If you use an authenticator app for two-step verification, move your accounts to another device or save your backup codes first.<\/li><\/ul>On a Google Pixel, go to <em>Settings &gt; System &gt; Reset options &gt; Erase all data (factory reset)<\/em>. On a Samsung Galaxy phone, go to <em>Settings &gt; General management &gt; Reset &gt; Factory data reset<\/em>. Menu names differ on other phones, so check your manufacturer&#8217;s support site.<\/div>\n\n\n<\/div><\/div><\/div>\n\n\n\n\n\n\n<h3>Stay Protected: Block Ads and Malicious Sites<\/h3>\n\n<p>No scan can prove a device is completely clean, so it helps to block threats before they reach you. Most infections start with a malicious ad or a fake download button \u2014 so blocking them at the source is your best defense.<\/p>\n\n<p>We recommend <a href=\"https:\/\/adguard.com\/?aid=29616\" target=\"_blank\" rel=\"sponsored nofollow noopener noreferrer\"><strong>AdGuard<\/strong><\/a>, which blocks malicious ads, phishing pages, and dangerous redirects before they can reach you.<\/p>\n\n<p>\ud83d\udc49 <a href=\"https:\/\/adguard.com\/?aid=29616\" target=\"_blank\" rel=\"sponsored nofollow noopener noreferrer\"><strong>Download AdGuard and browse safely<\/strong><\/a><\/p>\n\n\n<h2 class=\"wp-block-heading\">Frequently Asked Questions (FAQ) About the \u201cEmail On Hold\u201d Email Scam<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What is the \u201cEmail On Hold\u201d email scam?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The \u201cEmail On Hold\u201d scam is a phishing campaign that sends fake notifications claiming that unread or pending emails are being held in your account. Victims are told to click a button such as \u201cView Pending Emails\u201d to review or release them. The link instead leads to a fake login page that captures email credentials for cybercriminals.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Is the \u201cEMAIL ONHOLD\u201d message legitimate?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No. The \u201cEMAIL ONHOLD\u201d notification is not associated with any legitimate email provider. Real email services will not send messages claiming you have pending or held emails that must be manually released through a link. Any such email is a phishing attempt and should be deleted immediately.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Why does the scam mention 13 pending messages?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Phishers add details such as \u201c13 pending messages\u201d or timestamps to make the email appear more convincing. These details are fabricated. The goal is to create urgency so recipients believe they might miss important emails, invoices, or financial documents if they do not act quickly.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What happens if I click \u201cView Pending Emails\u201d?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Clicking the button redirects you to a phishing site disguised as an email login page. If you enter your username and password, attackers immediately collect the information. Some sites may also request additional security codes or personal information to expand the compromise.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What can scammers do with stolen email credentials?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">With stolen credentials, scammers can access your inbox, read and download sensitive messages, and use your account for further phishing attacks. They may reset passwords for other services linked to your email, commit financial fraud, impersonate you to scam your contacts, or sell your login details on dark web marketplaces.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How can I identify if the \u201cEmail On Hold\u201d email is fake?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Red flags include generic greetings, urgent language, suspicious sender addresses, inconsistent formatting, and links that do not match the domain of your real email provider. Hovering over the button or link usually reveals a suspicious or unfamiliar URL.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What should I do if I entered my password on the phishing site?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Immediately change your email password by visiting your provider\u2019s official website. Enable two-factor authentication for extra protection. Check your account\u2019s login history for unfamiliar activity and log out of other active sessions. Remove any unauthorized forwarding rules or connected apps. Notify your contacts in case phishing messages are sent from your account and report the scam to your email provider and relevant authorities.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Can this scam also infect my device with malware?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Most \u201cEmail On Hold\u201d campaigns focus on credential theft rather than malware. However, some phishing campaigns include attachments or links to malicious downloads. It is wise to run a full antivirus scan on your device after interacting with a suspicious email.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How can I protect myself from phishing scams like this?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Always verify suspicious emails by logging directly into your email provider through its official website instead of clicking on embedded links. Use strong and unique passwords, enable two-factor authentication, and keep software updated. Learn to recognize phishing indicators such as urgency, unusual requests, and mismatched domains.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Should I report the \u201cEmail On Hold\u201d scam?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Yes. Reporting helps providers and security organizations improve phishing detection. Use the \u201cReport phishing\u201d function in your email client or forward the email to <a>reportphishing@apwg.org<\/a>. In the U.S., you can report to the FTC. In the U.K., forward phishing emails to <a>report@phishing.gov.uk<\/a>. In the EU, report to your national cybercrime authority.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The Bottom Line<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The <strong>\u201cEmail On Hold\u201d<\/strong> phishing campaign is a dangerous, deceptively simple scam that succeeds because it exploits routine email behaviors and human reactions to urgency. The email\u2019s core lie \u2014 that messages are pending and require immediate action \u2014 is a compelling lure precisely because people rely on email for critical communications.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Protecting yourself requires vigilance: never click unsolicited links for account recovery, enable robust multi-factor authentication, use unique passwords stored in a password manager, and treat login pages accessed from email with skepticism. If you clicked a phishing link or submitted credentials, act immediately: change passwords from a trusted device, enable or reset 2FA, inspect login activity and mail rules, notify contacts, and scan devices for malware.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Phishing remains one of the most effective attack vectors because it targets people rather than systems. A combination of technical defenses and user education reduces risk significantly. If you or your organization is hit, a fast and thorough response dramatically reduces financial and reputational damage.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Stay cautious, verify before you click, and treat urgency in emails as the number one red flag.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>An email lands in your inbox with the subject \u201cEMAIL ON HOLD\u201d or something similar. Its design looks clean, it claims there are 13 pending messages, and a large button urges you to \u201cView Pending &#8230; <\/p>\n<p class=\"read-more-container\"><a title=\"Beware: Email On Hold Scam Claims You Have Pending Messages\" class=\"read-more button\" href=\"https:\/\/malwaretips.com\/blogs\/email-on-hold-scam\/#more-360218\" aria-label=\"Read more about Beware: Email On Hold Scam Claims You Have Pending Messages\">Read more<\/a><\/p>\n","protected":false},"author":50,"featured_media":360219,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[49],"tags":[],"class_list":["post-360218","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scam-reports","masonry-post","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts\/360218","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/users\/50"}],"replies":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/comments?post=360218"}],"version-history":[{"count":0,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts\/360218\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/media\/360219"}],"wp:attachment":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/media?parent=360218"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/categories?post=360218"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/tags?post=360218"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}