Fake popups from popular websites

Question

I just visited YouTube.com on Chrome and got a popup message that said "Your computer has a virus. You need to scan it with an antivirus". I think I had "OK" and "Cancel" buttons as options. It wasn't one of those loud ones with sounds and graphics, just the very simple gray Chrome popup in the top middle section that I know Chrome uses from time to time.

First thing I did is look left at the green lock to make sure I was on the right website, which it was, then shut off my machine immediately and unplugged the network cable. On another machine, I then looked up whether there's a live attack/compromise of YouTube, which I did not find. I then rebooted my desktop and checked some things(HW perf, newly installed programs, open TCP connections, running processes, etc) and did not find anything odd. Then I cleared all cache on my browser and went back to YouTube. Everything normal.

What are some possibilities on what happened?

I can only think of malware and XSS. I don't think it's a malware because I would have seen other signs.. Unless it's the sneakiest malware ever, I don't think it's a malware that pops up a fake warning once and never does anything else(altho I could just be not aware of it. But I do have quite tight control over my systems and if I do anything phishy I do it in VMs).

After I cleared cache I realized I could have double checked the browsing history to see if maybe it wasn't actually youtube, but I 100% checked the TLS lock at least before I shut it off.

And I've also seen other people(albeit non-techy) experience something similar, where they go to a popular website and still get those popups. Once I checked the browsing history after something similar happened to someone I know, and the person had gone to the correct website. I shrugged off, assuming the end user probably did something wrong. But this is the first time this ever happened to my machine and I'm more curious about how/what than scared.

Answer 1

Try a few different browsers on that machine to see if they all get the popup. If they don't, you might have a malicious extension or addon installed into chrome. If they do have the same problem, you might be a victim of DNS hijacking on the affected computer considering other machines on your local network don't experience this issue (although if they do it's still possible that your router has been compromised to the same end). If you open up your network adapter settings do you see anything under the IPV4 or IPV6 DNS settings that you didn't set?

There was a really interesting blog post on a similar case of DNS hijacking recently where a security researcher found malicious scripts on popular websites but only when browsed from his computer but I can't find it now. If I can find it I'll link it here.

Edit: Just to address the point about fake warnings, those can actually be a good source of ad revenue if the installation count is high enough. If the DNS hijacker exists, it is probably also inserting other ads into pages as well since that's easier to get reliable money from than attempting to gain and sell personal information. Also, as far as the green lock is concerned, it's possible that the main site resolves the same way but its external dependencies (a jquery cdn, for instance) resolve to something that will occasionally pad a bit extra into the original content.