Recurring Safari scam pop-ups persist on Mac after reinstall

SteveMac603 wrote:

... a full clean install with no third-party components involved

When you did the "full clean install," did you follow each and every step of this link from Owl-53, Erase All Content and Settings. with no exceptions? All the steps are required in that link. An ordinary erase/format followed by MacOS install, depending on the Mac model, does not "forget" 100% of everything, only the full steps from that link does that.

If you did follow ALL those steps, and then set up only a new vanilla admin user (no AppleID, no old users, no migration, no new installations), then I would suspect that either the problem lies with your router setup or with specific web sites you are seeing this on. Which web sites manifest the problem?

This is a Two Part Answer

OP wrote " Bitdefender " ?

Part 1 of 2

Third Party Security Software 

Get rid of it via the Specific Instructions of the Developer

This will include BitDefender

Windows-like viruses that self-replicate and affect macOS don’t exist because of the underlying UNIX Foundation and permission limitations.

The macOS operating system resides in a sealed and read-only volume that can’t be opened by users or third-party applications.

Mac app security enhancements are sufficient to protect computers from malware.

Adware and Malware can affect computers and are often downloaded from “shady” websites or developers who inject them into downloads.

Source: User tip from @Kurt Lang

What is malware? - Apple Community

Part 2 of 2

Thanks to a long standing contributor @John Galt 

➡️ Stop unwanted Notifications. ⬅️

Phony "tech support" / "ransomware" popups and web pages

Restart the computer in Safe Mode 

Do the issues persist ?

Sometimes a Safe Boot followed by a Normal Boot will just put things right.

If not - there could be something in the main User Account playing up. To further isolate this - Set up users, guests, and groups on Mac. Then log out of the Main User account and log into the dummy account and test again if the issue persists.

If the issue is present in the dummy account - then, this appears to be a System Wide issue on the computer.

Part 2 of 2

To Drill Down further and to avoid a session of Q&A, Q&A  and Q&A  

Download the Application Etrecheck  ( External Link ) directly from the Developer.

The Application is Not a " Silver Bullet "  and is  only a tool to examine the Hardware / Software used on this computer 

This is a Diagnostic Tool that makes no changes to the computer Hardware / Software used on this computer 

The application is free or paid from added features. 

The Report will Not Reveal Any Personal Information. 

Post back the Full Report - copy and paste - >>>> using the Additional Text Icon ( 3rd Icon to last ) <<<<

If the user believes these current issues stem specifically from macOS 26 Tahoe.

For a thorough test of both Tahoe / Hardware and to  determine the root cause of all the computer issues.

Use the “Atomic” option and select “Erase All Content and Settings.” Apple Silicon computer

Always make a Time Machine backup before proceeding.

Run the computer without installing any additional software and without restoring from your Time Machine backups.

Run the computer in this mode for approximately 4 to 6 hours and report back if the previous issues reoccur.

Certainly any website can initiate a Pop up using the standard mechanism controlled at Safari > Settings > Websites > Pop Up Windows, and even open a new page in a Window instead of a tab at Safari > Settings > Tabs > Open pages in Tabs instead of Windows, and make sure that is set to Always.

For the quest in finding someone else that has the same problem, every reported case here has been resolved with the above settings in Safari, removing the allowed Notifications in Safari, or deleting Web Hijackers identified with EtreCheck. If you are able to identify a particular website where this occurs without those known methods, we would be just as interested in knowing what that is.

SteveMac603 wrote:

I have not installed any third-party software other than Bitdefender, which reports no malware.

Bitdefender’s Web Protection is enabled, yet the pop-up

I’m trying to understand what could be causing it.

No surprise there...

re: < Bitdefender > Uninstall garbage apps— consider this your malware.

all third party apps that are Cleaners/Optimizers/VPN/Anti-Virus

all known to cause issues on the macOS

Recognize and avoid phishing messages, phony support calls

Recognize and avoid social engineering schemes including phishing messages, phony support calls, and other scams - Apple Support

Block pop-up ads and windows in Safari

Block pop-up ads and windows in Safari - Apple Support

Stop unwanted Notifications - John Galt

Stop unwanted Notifications - Apple Community

Third party AntiVirus is not recommended— it typically does nothing but add issues to the macOS and competes directly with Apple’s own built in security:

macOS antivirus - Protecting against malware in macOS - Apple Support

Security and your Apple Account Security and your Apple Account - Apple Support

Apple Platform Security - Apple Apple Platform Security - Apple Support

Protecting against malware in macOS

Protecting against malware in macOS - Apple Support

Protecting against malware in macOS

Protecting against malware in macOS - Apple Support

SteveMac603 wrote:

What I’m specifically asking is this: has anyone experienced a persistent, browser-based pop-up or redirect that survived a clean macOS installation

Since that's not possible, either your installation was not clean (e.g., you used Setup/Migration assistant to transfer prior data) or your browsing behavior post-installation was not clean (i.e., you visited a site that caused the issue).

To repeat my prior question, "Are you saying that if you erase your drive and reinstall macOS (without migrating/transferring user data), and the very first time you launch Safari you are presented with these popups?" I suspect the answer is 'no'. You transferred data/settings or you are browsing to websites with malicious code. Certainly classes of websites are more likely than others to fall into that category, and if you're choosing to visit them, well, I wish you luck with your problem.

steve626 wrote:

SteveMac603 wrote:

... a full clean install with no third-party components involved

When you did the "full clean install," did you follow each and every step of this link from Owl-53, Erase All Content and Settings. with no exceptions? All the steps are required in that link. An ordinary erase/format followed by MacOS install, depending on the Mac model, does not "forget" 100% of everything, only the full steps from that link does that.

If you did follow ALL those steps, and then set up only a new vanilla admin user (no AppleID, no old users, no migration, no new installations), then I would suspect that either the problem lies with your router setup or with specific web sites you are seeing this on. Which web sites manifest the problem?

You never answered this question about how you did the clean install, nor have you provided the web address that is causing the issue. Unclear what the purpose of your posting here really is. You can go into an Apple Store and enter certain web sites on the new Macs on display and in some cases there will be a pop up. What web site are you going to that causes this?

SteveMac603 wrote:

Thanks for the suggestions. I want to clarify a few points based on the troubleshooting already performed:

Safe Boot / New User Account: This Mac has undergone a full, clean macOS 26 installation1. , formatting the internal drive completely, without restoring anything from Time Machine or old backups. Any user-specific or system-level data that could cause this pop-up has already been eliminated, so creating a new user account or Safe Booting would not reveal anything new.

EtreCheck: While this tool can be helpful for system diagnostics, the pop-up is not caused by malware or any modification to the system1. . It appears intermittently in Safari and is consistent with ad scripts delivered by websites, which means it would not show up in an EtreCheck report.

Given these facts, the issue is not a system-level problem, nor related to the Mac OS installation.

As you wish

If, at some later time you decide to run the application and post the full report

Perhaps someone will have a look at the report and offer assistance / insights and possibly remedial action