Good morning, Fargo-Moorhead. If your phone just screamed that it has a virus, or an email begged you to update your ChatGPT payment method before your account gets cut off, take a breath. Most of the time the phone is fine. The scare is the product.

Fake AI tools are the new phishing costume

In June, Microsoft Threat Intelligence published research on campaigns that impersonate popular AI brands such as ChatGPT, Microsoft Copilot, DeepSeek, and Anthropic’s Claude. In September, Microsoft Defender followed up on the same pattern: phishing kits, fake installers, and malicious ads dressed up as AI tools people already trust.

Important detail from Microsoft: these campaigns do not mean ChatGPT, Copilot, Claude, or DeepSeek were compromised. Attackers borrowed the logos and the urgency. One ChatGPT-themed run sent as many as 100,000 emails in a single day asking people to update a payment method. Other lures pushed fake AI Windows plugins or lookalike DeepSeek installers that dropped info-stealing malware.

Curiosity plus a familiar brand is still one of the cheapest ways to get someone to click. Treat an unexpected “update your AI subscription” or “download this AI plugin” message the same way you treat a surprise invoice. Go to the real site yourself. Do not use the link in the message.

What a “phone virus” usually is

We hear this every week in the shop: “My phone has a virus.” On Android, what we find is almost never classic antivirus territory. This week we cleaned up two client phones that looked infected. Neither had a traditional virus. Both had the same messy combo.

First, a rogue app with no icon on the home screen. Something got installed (often from a bad download, a side-loaded APK, or a rushed “Allow” tap). It does not show up next to Messages and Camera, so people think nothing is there. It still runs. It can open ads, fire alerts, or keep trying to get you to install more junk. The fix is not another antivirus app. The fix is to open the full Apps list in Settings, find the stranger, and uninstall it.

Second, browser push notifications. Chrome (and other browsers) can ask a website for permission to send you alerts. Say yes once on a sketchy page and that site can keep pushing “Your phone is infected” banners that look official. They are not system virus scans. They are ads and scare tactics from a website you allowed. Turning the notifications off for that site (or for all sites) makes the fake virus stop screaming.

iPhone users get fewer of the iconless-app problems because App Store rules are tighter, but the browser and system notification trick still shows up. Same habit: if an alert looks like a virus scan, check whether it came from Safari, Chrome, or a website, not from Apple.

You probably do not need phone antivirus

Consumer phone antivirus is usually a distraction. Modern Android and iOS already ship with strong platform protections. Stacking a third-party “antivirus” app on top often adds another permission-hungry install, more ads, and a false sense of safety. The habits that actually help are simpler: keep the OS updated, only install apps from the official store, refuse unexpected downloads, and treat urgent payment or virus pop-ups as hostile until proven otherwise.

If a scare screen tells you to call a phone number or buy a cleanup tool right now, hang up on that screen. Close the tab. Do not call the number in the ad.

Clean it up in five minutes

Android: find and remove the iconless app

  1. Open Settings, then Apps (sometimes labeled Apps and notifications or Application manager).
  2. Show all apps, not just the ones with icons. Sort by size or recently installed if that helps.
  3. Uninstall anything you do not recognize and did not mean to install. When in doubt, search the exact app name before you keep it.
  4. Restart the phone after removals.

Chrome (and most browsers): shut off scam site alerts

  1. Open Chrome, tap the three-dot menu, then Settings, then Notifications (or Site settings, then Notifications).
  2. Revoke permission for any site you do not trust. Better: turn off site notifications entirely so random pages cannot buzz you again.
  3. Also check the phone’s system Settings → Notifications and turn off alerts for the browser if you want a hard stop.

iPhone quick check

  1. Settings → Notifications: review which apps can alert you.
  2. In Safari or Chrome, clear site notification permission for anything that looks like a virus warning page.
  3. Keep iOS itself updated from Settings → General → Software Update.

If the phone still behaves oddly after that (sudden data use, unknown accounts signed in, constant pop-ups that return after uninstall), that is when a tech visit earns its keep. Start with the boring cleanup first.

Still curious about real AI (not the fake download)

Scareware and fake AI installers thrive because the real tools are useful and in the news. If you want a calm, local walkthrough of what AI can and cannot do, our Bonanzaville AI classes still have seats: Beginner Monday September 28, 11:30 AM–1:00 PM ($75) and Intermediate Wednesday September 30, 10:00–11:30 AM ($100).

If you want help checking a phone that will not stop yelling about viruses, or walking a team through how to spot AI-branded phishing, reach out to DarkHorse IT. It is a short conversation.

We talk through this kind of thing every week. Join us Thursdays at 7:40 AM on KFGO 790 AM.