The phone number in the alert did not belong to Microsoft. A quick WHOIS lookup revealed it was a VoIP number routed through a call center in Mumbai.
Your mouse cursor freezes. The task manager won’t open. A robotic female voice begins to recite from your speakers: “Warning! Your IP address is compromised.” idm virus notification
Welcome to the strange, lucrative, and surprisingly resilient world of the "IDM Virus Notification"—a scam that weaponizes a legitimate piece of software to become the most effective phishing lure of the 21st century. To understand the scam, you must first understand the software. Internet Download Manager, developed by a small company called Tonec in the Czech Republic, is a piece of legacy software. For nearly two decades, it has done one thing exceptionally well: accelerate file downloads by splitting them into multiple streams. It is utilitarian, ugly, and beloved by power users who routinely download large files. The phone number in the alert did not belong to Microsoft
When you call the number on the fake IDM alert, you are not connected to Microsoft. You are connected to a boiler room. The person on the other end has a heavy accent, a script, and a remote access tool like AnyDesk or TeamViewer ready to go. The task manager won’t open
Meanwhile, the scammers have evolved. The classic “IDM Virus” of 2018 was crude—full of spelling errors and pixelated icons. The 2025 version is a marvel of social engineering. It detects your browser language and displays the alert in fluent Spanish, German, or French. It uses your local IP address to guess your city and displays it in the alert: “Location: Austin, TX detected. Suspicious login.”
“The IDM scam is brilliant because it creates a sense of urgency,” says Holloway. “It says ‘virus’ and ‘illegal activity.’ It threatens legal action. It freezes the interface. The victim feels they have thirty seconds to act before their hard drive is wiped. Rational thought shuts down.” Tonec, the developers of IDM, have spent the last five years fighting an entity they never created. The company has issued countless blog posts and FAQ entries clarifying: “IDM does not display virus notifications. If you see one, you have adware or a PUP (Potentially Unwanted Program).”