All Devices Strange download pop-up (index.html). Bug or Malware?

[Bluevioletsky]

Hello everyone,

Since updating to 13.3.1 (a few days ago), on some websites (including this one) I get a download pop-up that asks me if I want to download “index.html”. I switched from Safari to Chrome and noticed the same thing happens. The pop-up occurs so frequently, on both my IPhone XR and IPad, that I decided to download the file on one of my devices. I quickly deleted it after because it seemed suspicious (when I opened it, I noticed it was a blank white page).

Has anyone else noticed this, or could it be a malware pop-up?

 

[barbu]

can you send the file to a desktop computer and open with an editor to see the source code? If so, please post it here and we can have a look.

 

[Puppuccino]

It seems to be a common thing and could be related to adverts on a site but I personally haven’t experienced this.

RE: https://discussions.apple.com/thread/251094484

 

[revmacian]

can you send the file to a desktop computer and open with an editor to see the source code? If so, please post it here and we can have a look.

I'm betting the file has nothing in the body tag but quite a lot (scripts) in the head tag - this would yield a blank page but allow scripts to run. Knowing that most people will open a downloaded file out of curiosity, this would be an effective way of delivering malware.

I also recommend disabling this option in Safari prefs:

 

[barbu]

I'm betting the file has nothing in the body tag but quite a lot (scripts) in the head tag - this would yield a blank page but allow scripts to run. Knowing that most people will open a downloaded file out of curiosity, this would be an effective way of delivering malware.

Very possible, which is why I was curious about the actual code content. I hope OP is able to share the code here.

 

[revmacian]

Very possible, which is why I was curious about the actual code content. I hope OP is able to share the code here.

Yes, I'm curious about it myself.

 

[sirghost]

Hello everyone,

Since updating to 13.3.1 (a few days ago), on some websites (including this one) I get a download pop-up that asks me if I want to download “index.html”. I switched from Safari to Chrome and noticed the same thing happens. The pop-up occurs so frequently, on both my IPhone XR and IPad, that I decided to download the file on one of my devices. I quickly deleted it after because it seemed suspicious (when I opened it, I noticed it was a blank white page).

Has anyone else noticed this, or could it be a malware pop-up?

View attachment 892345 View attachment 892346

Download the file and attach it here if you are unsure of how to read the code in it. This way everyone else here can open it and see what is in its code for you.

 

[Ruggy]

index.html is very often the homepage of a website.
I don't know why you've got this problem though.

 

[OllyW]

@arn @WildCowboy

Is this an issue with our adverts?

 

[revmacian]

@arn @WildCowboy

Is this an issue with our adverts?

I wonder if this is a malicious advert made to look like a problem so people will download the file and open it. But, I'm always suspicious of everyone and everything so I could be wrong.

 

[colonel179]

Every time I enter a website Safari downloads 1-5 index.html files automatically. If I refresh or click something, whenever the page finishes loading, it downloads the files again. Denying downloads from setting stops downloading them in the computer, but it still shows as a failed download.

Why is this happening? It started today after I turned on the computer. It hasn't downloaded any update, and I haven't installed anything new in more than a month.

I searched in google and found a thread that said to delete the com.apple.safari folder in Library, but it didn't work either.

Is there a solution to this?

 

[macintoshmac]

Literally downloading? You should download Malware Bytes and let it do its thing. Then, download Onyx and clear up cache. Yes, delete the file you mentioned. See if all this helps. Has the computer become sluggish suddenly, stays warmer than usual suddenly?

 

[colonel179]

Literally downloading? You should download Malware Bytes and let it do its thing. Then, download Onyx and clear up cache. Yes, delete the file you mentioned. See if all this helps. Has the computer become sluggish suddenly, stays warmer than usual suddenly?

Yes, it downloads the file into the Downloads folder. Deleted the folder, but it keeps downloading the files.
The computer has not been slow or behaving any differently.

 

[macintoshmac]

Yes, it downloads the file into the Downloads folder. Deleted the folder, but it keeps downloading the files.
The computer has not been slow or behaving any differently.

Download Malwarebytes and see what happens.

 

[arn]

Seems widespread. Doesn't necessarily seem like malware though.

Can you email me the index.html file? arn@normalkid.com

arn

 

[Blokus18]

I'm having exactly the same issue, it doesn't happen on every website though. It seams to be when it comes across an image for some reason it downloads an index.html file that looks like it pops out of the image. Started happening today, haven't changed any settings or updates.

 

[IowaLynn]

One if the later posts on Apple community:

Once I turn on Adblock, it turns on VPN, and the download index no longer pops up. There should be no need to do this though.

Community post

I feel though that using a VPN and something like Adguard are common sense and needed in today's world. Today's form of Disinfectent as it were.

If someone wants to do any testing, one idea is to use a VM whenever possible - no thank you from Apple though, and be off line and air gap - IoT and new vulnerabilities show up daily at all levels.

 

[crestify]

Same thing is happening to me, Mojave 10.14.3

Did someone find a solution yet?

 

[macintoshmac]

Yes, it downloads the file into the Downloads folder. Deleted the folder, but it keeps downloading the files.
The computer has not been slow or behaving any differently.

I'm having exactly the same issue, it doesn't happen on every website though. It seams to be when it comes across an image for some reason it downloads an index.html file that looks like it pops out of the image. Started happening today, haven't changed any settings or updates.

Same thing is happening to me, Mojave 10.14.3

Did someone find a solution yet?

At this point when the issue spans across multiple OSs it would be helpful to start listing out websites that we are facing the issue with. It is possible that we arrive at a single or a bunch of websites we are all facing the issue with.

 

[colonel179]

Update:
I haven't done absolutely anything, yet the files no longer download with every website, but now it has only happened once, after opening many tabs and going to many websites.

This is creepy!
I downloaded MacOS installer because I was ready to clean install my Mac, but somehow it seems like it is fixing itself? I didn't restart the Mac, I didn't close safari, I didn't turned it off. The only think I did was put it in standby mode for a while.

EDIT: Update 2: It came back. It only happens with Safari.

 

[BowersWilkins]

Same problem in new iMac with 10.15.3 Catalina. It's frustrating. The index.html file is downloaded without need over and over again when you change the page. It looks more like an operating system or Safari bug than malware, I think.


If someone has a solution, it would be appreciated, although it seems that we will have to wait for an Apple update.


Sorry for my English

 

[revmacian]

Same problem in new iMac with 10.15.3 Catalina. It's frustrating. The index.html file is downloaded without need over and over again when you change the page. It looks more like an operating system or Safari bug than malware, I think.


If someone has a solution, it would be appreciated, although it seems that we will have to wait for an Apple update.


Sorry for my English

I'm using Catalina (10.15.3) on a MBP and MBA and I'm not seeing this bug at all. So, I'm not sure if this is a Safari bug or a website code bug. I browse the web quite a bit and have never seen this issue.

Also, your English is better than some native Americans I've met

 

[BowersWilkins]

I'm using Catalina (10.15.3) on a MBP and MBA and I'm not seeing this bug at all. So, I'm not sure if this is a Safari bug or a website code bug. I browse the web quite a bit and have never seen this issue.

Also, your English is better than some native Americans I've met

Haha, thank you 🤓

The index.html is downloaded from many different web pages, all kinds of pages and without relationship between them. The file is downloaded on most pages (not always) so I think it's a problem with Safari (or Catalina). It is strange. It started happening a couple of days ago, more or less.

Thanks again.

 

[revmacian]

How many people who have actually experienced this index download popup are also running an adblocker?

 

[BowersWilkins]

How many people who have actually experienced this index download popup are also running an adblocker?

Good question, but I am not using an adblocker (and no extensions in Safari).