Nonamenba Pop-Ups

The Nonamenba pop-ups designate a group of deceiving websites designed with the sole purpose of promoting various barely-functional PUPs (Potentially Unwanted Programs) to Mac users. The sites use the common tactic of claiming to have detected a malware threat on the user's device. To address the issue a link is provided to a supposed application that will remove the threat without a trace. All claims made by the Nonamenba pop-ups or any other similar website should be ignored completely, as they are false entirely. After all, no website can conduct an anti-malware scan on its own. 

When users land on any of the Nonamenba pop-us, they will be presented with a pop-up message stating that a previously visited website has infected the device's macOS. Closing the pop-up reveals the next message displayed on the main page. Here, the website reiterates the warning and offers to conduct a scan of the system if the user clicks the corresponding 'Scan Now' button. Clicking the button initiates a fake scan that claims ultimately to have detected a malware threat named 'Bankworm.'  To further boost its supposed legitimacy, the website also will display various user details such as brand, IP address, OS version, ISP, geolocation, etc.

However, here all pretenses are dropped. The Nonamenba site will direct the users towards downloading an application named Advanced Mac Cleaner. However, the promotional page that opens is for an entirely different product called Smart Mac Booster. The application is downloaded on the system as a 'maccleaner.pkg' file, a commonly used vehicle for the distribution of PUPs. Users should keep in mind that the Smart Mac Booster is also classified as rogue software. The application requires a paid activation to become operational but that is just another lie. Even after paying for the product, users will discover that it is still as nonoperational as before.