Many websites pop up a request to send you notifications. Scammers have learned to make that request look like a required step, for example to start a quiz or keep reading a story. Once someone clicks Allow, the site can keep sending messages long after the visitor has left, sometimes even when the browser is not visibly open.
Malwarebytes found that some customers who thought their devices were infected actually had notifications from quiz sites. The pages made it seem that allowing notifications was needed to take the quiz. Separately, researchers at HUMAN Security described a larger operation they called Pushpaganda, which used sensational, often AI-generated articles to get people to enable notifications.
The messages that follow can be alarming. Researchers saw fake virus warnings, false arrest warrants, fake financial alerts and messages pretending to be missed calls from family members. Because the notifications appear through the browser and the operating system, they can look official, and by then people rarely remember which site they allowed.
Allowing notifications does not install malware by itself, which is why a scan may find nothing wrong. The risk is that someone clicks a notification and lands on a harmful page or downloads something dangerous. In an office, a single employee clicking a fake alert could cause real trouble.
What you should do
- Tell staff to treat any prompt saying to allow notifications to continue as a warning sign.
- Review browser notification settings on work computers and phones and block sites you do not recognize.
- Remove unwanted notification permissions through browser settings instead of clicking links inside the alerts.
- Remind employees not to act on alarming pop-up warnings and to report them to whoever handles your IT.
- Ask Computech about web filtering that can block known scam websites on company devices.
Computech prepares these summaries with AI assistance, based on public news reports. See the original report for full details.
