Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

Lolu chungechunge lwabekwa kunqolobane. Uyacelwa ubuze umbuzo omusha uma udinga usizo.

Unsolicited paypal window on launch appears

  • 5 uphendule
  • 1 inale nkinga
  • 31 views
  • Igcine ukuphendulwa ngu hyperact

more options

Firefox announced an update a few days ago which I accepted, and on relaunch it attempted to reload all previously open tabs. A small second window appeared and tried to load this URL:

https://www.paypal.com/webapps/hermes/fallback?product=ec&token=BA-4BN59940BV228700C&fallback=1&reason=bootstrap_failed&Z3JncnB0=

The window went into a loop, waiting for a response and retrying until I cancelled the reload. I had cookies blocked and there were no open tabs that had anything to do with PayPal, they were all developer resources.

The URL points to a PayPal error page indicating there was a problem with a transaction and my account was not charged. No attempted charge should have happened.

I quit FF and relaunched and the same window appeared again, with the same URL but using a different token. I closed all open tabs, quit FF immediately, went to the Mozilla download page using Safari, downloaded the latest version and installed it. The suspicious window did not reappear on launch.

The next day FireFox put up another notice about an update, right on the heels of the last one. Were there two updates within a day of each other this week?

I could find nothing about this in a Google search. I should add that both update notices were standard Mac dialog windows, not popups from a web page. I was either in GitHub, Slack, or Asana at the time.

Does anyone know what might have caused it? It looks like a suspicious attempt to contact Paypal.

Mac OS X 10.11.6 FireFox 53.0

Firefox announced an update a few days ago which I accepted, and on relaunch it attempted to reload all previously open tabs. A small second window appeared and tried to load this URL: https://www.paypal.com/webapps/hermes/fallback?product=ec&token=BA-4BN59940BV228700C&fallback=1&reason=bootstrap_failed&Z3JncnB0= The window went into a loop, waiting for a response and retrying until I cancelled the reload. I had cookies blocked and there were no open tabs that had anything to do with PayPal, they were all developer resources. The URL points to a PayPal error page indicating there was a problem with a transaction and my account was not charged. No attempted charge should have happened. I quit FF and relaunched and the same window appeared again, with the same URL but using a different token. I closed all open tabs, quit FF immediately, went to the Mozilla download page using Safari, downloaded the latest version and installed it. The suspicious window did not reappear on launch. The next day FireFox put up another notice about an update, right on the heels of the last one. Were there two updates within a day of each other this week? I could find nothing about this in a Google search. I should add that both update notices were standard Mac dialog windows, not popups from a web page. I was either in GitHub, Slack, or Asana at the time. Does anyone know what might have caused it? It looks like a suspicious attempt to contact Paypal. Mac OS X 10.11.6 FireFox 53.0

Okulungisiwe ngu hyperact

All Replies (5)

more options

How did you recieve the notice? Pop-up, full window?

For almost a year, an epidemic of Fake Update Notices have been popping up all over the place. https://support.mozilla.org/en-US/kb/forum-response-i-found-fake-firefox-update


. Whenever you get a message / popup that software / files need to be updated;

DO NOT USE ANY OF THE PROVIDED LINKS

While this may be a legitimate message, it could also be Malware or a Virus. Anytime you want or need to check for upgrades, go to the website of the True Owner of the program in question. For example, to check out Firefox, go to https://www.mozilla.org

You can report such a site at; http://www.google.com/safebrowsing/report_phish/ Google Report Phishing Page which is the same when done while on site by going to Help > Report Web Forgery

http://www.mozilla.org/en-US/legal/fraud-report/ Help us safeguard Mozilla’s trademarks by reporting misuse

more options

You may have ad/mal-ware. Further information can be found in this article; https://support.mozilla.org/en-US/kb/troubleshoot-firefox-issues-caused-malware?cache=no

Run most or all of the listed malware scanners. Each works differently. If one program misses something, another may pick it up.


Separate Security Issue: Update your Flash Player Note: Windows users should download the ActiveX for Internet Explorer. and the plugin for Plugin-based browsers (like Firefox).

Note: Windows 8 and Windows 10 have built-in flash players and Adobe will cause a conflict. Install the plugin only. Not the ActiveX.

Flash Player Version: 25.0.0.148

https://get.adobe.com/flashplayer/ Direct link scans current system and browser Note: Other software is offered in the download. <Windows Only>

https://get.adobe.com/flashplayer/otherversions/ Step 1: Select Operating System Step 2: Select A Version (Firefox, Win IE . . . .) Note: Other software is offered in the download. <Windows Only> +++++++++++++++++++ See if there are updates for your graphics drivers https://support.mozilla.org/en-US/kb/upgrade-graphics-drivers-use-hardware-acceleration

more options

I edited my question before I saw these responses. The update window was not a popup from a web site, it was a standard FF update notice in a separate system window with an option to cancel or download, These are the sites that were open when I received the first update notice, all of which are trusted (I noted them before I shut down FireFox):

Github Asana Mantis (private bug database) Google Drive Slack material.io (Google Android reference) A website being developed on an unpublished server

These are trusted, safe sites. It is possible I picked up something at some other time, but it definitely was not a popup from an open tab when the first notice appeared.

Okulungisiwe ngu hyperact

more options

Check your system for malware, anyway. You never know.

more options

FredMcD said

Check your system for malware, anyway. You never know.

There are few Mac malware checkers that do any good. Apple discourages users from installing them because they not only are largely useless but they can interfere with normal OS functioning. I do have the OS set up to automatically update Apple's malware and data checkers. User awareness is more reliable, and I'm pretty aware. I've seen the fake popups and this wasn't one of those.

Actually, the help file you linked to (which I'd already read) links to Apple's support page which recommends not installing malware checkers.