All Devices Strange download pop-up (index.html). Bug or Malware?

Bluevioletsky

macrumors newbie
Original poster
Feb 3, 2020
1
0
Hello everyone,

Since updating to 13.3.1 (a few days ago), on some websites (including this one) I get a download pop-up that asks me if I want to download “index.html”. I switched from Safari to Chrome and noticed the same thing happens. The pop-up occurs so frequently, on both my IPhone XR and IPad, that I decided to download the file on one of my devices. I quickly deleted it after because it seemed suspicious (when I opened it, I noticed it was a blank white page).

Has anyone else noticed this, or could it be a malware pop-up?

408BD3F1-614B-4E6A-B569-F2862E95508E.jpeg
4F048EE8-E6E0-4832-9BF8-F48320B506B9.jpeg
 

revmacian

macrumors 68000
Oct 20, 2018
1,686
1,380
USA
can you send the file to a desktop computer and open with an editor to see the source code? If so, please post it here and we can have a look.
I'm betting the file has nothing in the body tag but quite a lot (scripts) in the head tag - this would yield a blank page but allow scripts to run. Knowing that most people will open a downloaded file out of curiosity, this would be an effective way of delivering malware.

I also recommend disabling this option in Safari prefs:
Screen Shot 2020-02-06 at 2.57.28 PM.png
 
  • Like
Reactions: barbu

barbu

macrumors 6502a
Jul 8, 2013
537
595
wpg.mb.ca
I'm betting the file has nothing in the body tag but quite a lot (scripts) in the head tag - this would yield a blank page but allow scripts to run. Knowing that most people will open a downloaded file out of curiosity, this would be an effective way of delivering malware.
Very possible, which is why I was curious about the actual code content. I hope OP is able to share the code here.
 
  • Like
Reactions: revmacian

sirghost

macrumors regular
Jun 22, 2014
109
119
Hello everyone,

Since updating to 13.3.1 (a few days ago), on some websites (including this one) I get a download pop-up that asks me if I want to download “index.html”. I switched from Safari to Chrome and noticed the same thing happens. The pop-up occurs so frequently, on both my IPhone XR and IPad, that I decided to download the file on one of my devices. I quickly deleted it after because it seemed suspicious (when I opened it, I noticed it was a blank white page).

Has anyone else noticed this, or could it be a malware pop-up?

View attachment 892345View attachment 892346
Download the file and attach it here if you are unsure of how to read the code in it. This way everyone else here can open it and see what is in its code for you.
 

Ruggy

macrumors 6502
Jan 11, 2017
367
198
index.html is very often the homepage of a website.
I don't know why you've got this problem though.
 

colonel179

macrumors member
Jun 10, 2014
74
12
Every time I enter a website Safari downloads 1-5 index.html files automatically. If I refresh or click something, whenever the page finishes loading, it downloads the files again. Denying downloads from setting stops downloading them in the computer, but it still shows as a failed download.

Why is this happening? It started today after I turned on the computer. It hasn't downloaded any update, and I haven't installed anything new in more than a month.

I searched in google and found a thread that said to delete the com.apple.safari folder in Library, but it didn't work either.

Is there a solution to this?
 
  • Like
Reactions: Blokus18

macintoshmac

macrumors 68040
May 13, 2010
3,598
3,146
Literally downloading? You should download Malware Bytes and let it do its thing. Then, download Onyx and clear up cache. Yes, delete the file you mentioned. See if all this helps. Has the computer become sluggish suddenly, stays warmer than usual suddenly?
 

colonel179

macrumors member
Jun 10, 2014
74
12
Literally downloading? You should download Malware Bytes and let it do its thing. Then, download Onyx and clear up cache. Yes, delete the file you mentioned. See if all this helps. Has the computer become sluggish suddenly, stays warmer than usual suddenly?
Yes, it downloads the file into the Downloads folder. Deleted the folder, but it keeps downloading the files.
The computer has not been slow or behaving any differently.
 

Blokus18

macrumors newbie
Feb 7, 2020
1
0
I'm having exactly the same issue, it doesn't happen on every website though. It seams to be when it comes across an image for some reason it downloads an index.html file that looks like it pops out of the image. Started happening today, haven't changed any settings or updates.
 

IowaLynn

macrumors 68000
Feb 22, 2015
1,543
349
One if the later posts on Apple community:
Once I turn on Adblock, it turns on VPN, and the download index no longer pops up. There should be no need to do this though.
Community post

I feel though that using a VPN and something like Adguard are common sense and needed in today's world. Today's form of Disinfectent as it were.

If someone wants to do any testing, one idea is to use a VM whenever possible - no thank you from Apple though, and be off line and air gap - IoT and new vulnerabilities show up daily at all levels.
 
  • Like
Reactions: revmacian

macintoshmac

macrumors 68040
May 13, 2010
3,598
3,146
Yes, it downloads the file into the Downloads folder. Deleted the folder, but it keeps downloading the files.
The computer has not been slow or behaving any differently.
I'm having exactly the same issue, it doesn't happen on every website though. It seams to be when it comes across an image for some reason it downloads an index.html file that looks like it pops out of the image. Started happening today, haven't changed any settings or updates.
Same thing is happening to me, Mojave 10.14.3

Did someone find a solution yet?
At this point when the issue spans across multiple OSs it would be helpful to start listing out websites that we are facing the issue with. It is possible that we arrive at a single or a bunch of websites we are all facing the issue with.
 

colonel179

macrumors member
Jun 10, 2014
74
12
Update:
I haven't done absolutely anything, yet the files no longer download with every website, but now it has only happened once, after opening many tabs and going to many websites.

This is creepy!
I downloaded MacOS installer because I was ready to clean install my Mac, but somehow it seems like it is fixing itself? I didn't restart the Mac, I didn't close safari, I didn't turned it off. The only think I did was put it in standby mode for a while.

EDIT: Update 2: It came back. It only happens with Safari.
 
Last edited:

BowersWilkins

macrumors newbie
Feb 8, 2020
3
1
Same problem in new iMac with 10.15.3 Catalina. It's frustrating. The index.html file is downloaded without need over and over again when you change the page. It looks more like an operating system or Safari bug than malware, I think.


If someone has a solution, it would be appreciated, although it seems that we will have to wait for an Apple update.


Sorry for my English :oops:
 

revmacian

macrumors 68000
Oct 20, 2018
1,686
1,380
USA
Same problem in new iMac with 10.15.3 Catalina. It's frustrating. The index.html file is downloaded without need over and over again when you change the page. It looks more like an operating system or Safari bug than malware, I think.


If someone has a solution, it would be appreciated, although it seems that we will have to wait for an Apple update.


Sorry for my English :oops:
I'm using Catalina (10.15.3) on a MBP and MBA and I'm not seeing this bug at all. So, I'm not sure if this is a Safari bug or a website code bug. I browse the web quite a bit and have never seen this issue.

Also, your English is better than some native Americans I've met :)
 

BowersWilkins

macrumors newbie
Feb 8, 2020
3
1
I'm using Catalina (10.15.3) on a MBP and MBA and I'm not seeing this bug at all. So, I'm not sure if this is a Safari bug or a website code bug. I browse the web quite a bit and have never seen this issue.

Also, your English is better than some native Americans I've met :)
Haha, thank you 🤓

The index.html is downloaded from many different web pages, all kinds of pages and without relationship between them. The file is downloaded on most pages (not always) so I think it's a problem with Safari (or Catalina). It is strange. It started happening a couple of days ago, more or less.

Thanks again.
 
  • Like
Reactions: revmacian

revmacian

macrumors 68000
Oct 20, 2018
1,686
1,380
USA
How many people who have actually experienced this index download popup are also running an adblocker?