Discussion websites and forums for Apple users are getting flooded with questions about a pop-up suddenly appearing on their Safari and Google Chrome browsers stating, “Do you want to download occ?” No one can confirm nor deny if this is a virus on the browser, and no official statement has been released by the Apple officials since the first day this was posted on the Apple community.
The “Do you want to download occ” pop-up message is appearing on every Apple device, like iPhones, iPads, and Macs. So far, the only common ground, or at least most of them who are experiencing these suspicious pop-ups, is that they are visiting a news website. Here are some contexts:
Actually, I just came across another post, and it looks like it’s specific to news sites, perhaps a new way the OS manages cookies or something. – mykeyhope
It popped up while I was browsing on Time.com and on another website as well. – AssignmentAny2287
Seen the same thing in Safari several times on different sites since upgrading to iOS 18. CBS Sports, ESPN, etc. I have at least 4 different ones, so I don’t believe it’s site specific. – FSUghost

More about the OCC pop-up
This browser pop-up could be a necessary code required by the OS or the browser in order to display the web page properly—a cross-site tracking module maybe. It could also be a bug in the recent system that has something to do with the browsing operation, as some Apple users claim to have noticed it after upgrading to a recent version, not specifically iOS 18. A malware infection may also be the cause, but this is the least we can think of, because Apple is known for its robust security features that help prevent malicious software from running on its environment. Hence, it is important to note that Apple devices are not completely immune to malware attacks. We know for a fact that there have been instances of viruses made specifically for Macs, and the number of threats that target Apple users is increasing.
While the attacks on Apple devices are increasing, its users are becoming more cautious, especially when dealing with these kinds of unknown pop-ups. Clever users just ignore the pop-ups and cease entirely the operation of the browser. Bear in mind that clicking on the “X” button to close the window is not that helpful at all, as the pop-up is persistent. In addition, in the majority of the online fraud pop-ups, the “X” button is often a clickbait, which doesn’t serve its original purpose. Instead of closing the window, it executes the intended risky actions of the pop-up.
Does the pop-up infect the device?
Viewing the “Do you want to download occ” pop-up does not instantaneously infect the device with a virus. If you clicked on the Download button, there may be some consequence, but we cannot confirm that it is a virus infection. To confirm if the computer is safe, you might as well run a full scan of your trusted antivirus program. For this kind of multi-platform suspicious behavior, we would recommend Combo Cleaner. It works on both iOS and macOS.
About the Scanner: Combo Cleaner is a trusted computer security and optimization tool equipped with a powerful virus and malware detection engine. This program can guard the device against pop-ups, redirects, and similar threats, whether it has infected PC, Mac, Android, or iOS. It is available on the App Store.


I’m on iOS 17.6.1 so it doesn’t appear to be related to just iOS 18.
It appears that Apple is not yet aware of this OCC issue. In the meantime, switch to another browser and forget about Safari. I’m using Google Chrome now, and there are no pop-ups or anything.
So you’re implying that Google is behind this malware?
Reading COMPREHENSION…
I think the issue is not only for Safari users. I am seeing this pop-up using Google Chrome on my iPhone that runs in iOS 16.5.
“Clever users just ignore the pop-ups, and since it comes with an “X” (close) button, it is just right to click on that part.”
Please be very cautious when trusting the “X” button on a popup window. Crafty hackers may disguise a malicious button as a standard GUI-style control and catch you out anyway.
My approach is to cancel the whole session whenever I’m not 100% sure it’s a bona fide window. Which is pretty much every time.
@mike211 No, that’s not the issue. Prevent tracking and all other security, including block pop ups, is enabled on my and most user’s iPhones, all cache and history cleared, etc, but this is still repeatedly occurring.
I just downloaded the 17.7 patch, and I still get asked if I want to download OCC on my iPad. I was hoping that would have fixed it.
Prevent cross-site tracking was always on and still is. I have never selected yes to the OCC request. I just close the window when it pops up.
Anything else I should do?
Here’s what I’ve done to block the pop-up about downloading the “OCC” file.
1. On your iPhone or iPad, open the Settings page.
2. Look for Safari and open it.
3. Scroll down to “Prevent Cross-Site Tracking” and turn the slider to “ON”.
Good idea, but… that’s the default setting, and it doesn’t stop the download request, either.