Why scammers want you to allow push notifications

A simple click to "Allow" notifications on a quiz or story website can lead to a flood of unwanted messages warning about viruses, missed payments, or legal trouble. While these alerts may appear as new security issues, they often stem from a permission granted earlier to a deceptive site.

Browser push notifications transform a one-time website visit into a persistent channel for scammers to reach users even after they've left the site. This permission allows websites to send messages through browsers and operating systems, regardless of whether the browser is actively open.

Scammer advantages

For scammers, notification permissions offer multiple benefits. They provide repeat opportunities to lure users back to their sites, create convincing fake alerts that impersonate security warnings or messages from known contacts, and distance the scams from their original deceptive origins. Most importantly, they generate multiple revenue streams through advertising, affiliate promotions, scams, and unwanted downloads.

Campaign details

Malwarebytes' investigation, published March 9, began with customers reporting suspected device infections that turned out to be caused by web push notifications from deceptive quiz sites. The quizzes were legitimate, but the trick lay in convincing users they needed to allow notifications to participate.

On April 14, HUMAN Security's Satori researchers exposed a larger operation called Pushpaganda, which used sensational AI-generated articles to lure visitors. Once on the site, users were prompted to enable notifications, followed by messages about fake arrest warrants, false financial alerts, and missed calls from family members.

Scam Guard data shows weekly reports of notification abuse, with notable dips following public exposure of these campaigns. HUMAN Security researchers observed approximately 240 million advertising bid requests associated with Pushpaganda domains in a single seven-day period at its peak.

Protection measures

Users should only allow notifications when genuinely wanting ongoing messages from a site. Treat "Allow notifications to continue" prompts as red flags, especially on quizzes, video pages, or unfamiliar websites. Browser protection tools like Malwarebytes Browser Guard can help block malicious websites.

For Android Chrome users, unwanted notifications can be managed through the notification shade's Unsubscribe option or by adjusting site settings in Chrome. Users should avoid clicking suspicious links within notifications and instead use built-in controls to manage permissions directly.