My security officer came to me yesterday, and said the CEO had clicked a "viruses detected, click yes to scan" popup, after which of course his laptop was crawling with viruses. So the SO wants to distribute directions on how to keep people from making the same mistake.
He asked me: "If I say, 'just close popups, don't click anything in it,' is that good enough?" I plan to talk to him about popup blockers and explaining to users about the social engineering aspect of what they see, but I'm interested in how to answer his question.
Specifically because I know a malicious coder could put an onunload() or unbeforeunload() event catcher in the popup code, so if they close the window, (I assume) the same code that runs when you click "Yes, please make a mess of my computer" can be run when you click the close box. But on the other hand if that's true, if a hacker had you open a popup window that is entirely under their control, why bother needing you to click a button in the first place? Why not just have attack code run in the popup?