Scam Sites Abuse Browser Push Alerts—Turn Them Off

A stream of virus warnings, missed-payment notices or legal threats may come from a website you once allowed to send browser notifications. These alerts do not mean malware was installed, but scammers can use them to lead household members to harmful links or dangerous downloads.

What happened

Deceptive websites are presenting legitimate browser permission prompts in misleading ways, according to Malwarebytes Labs. One investigation found quiz sites that made visitors believe clicking “Allow” was required to start a quiz. In reality, that choice gave the site permission to send future notifications.

A separate operation investigated by HUMAN Security used sensational stories and images, some showing signs of AI generation, to attract visitors. After receiving notification permission, its sites sent unrelated messages such as fake arrest warrants, false financial warnings and alerts designed to look like missed calls from family members.

Website notifications can keep appearing after the visitor leaves the page. Depending on the browser and device settings, they may even appear when the browser is not visibly running. This can make a clean device seem infected and gives scammers repeated chances to persuade someone to click.

Malwarebytes said its scans found no malware on devices reported by some affected customers. Support staff traced the alarming messages to previously approved web notifications instead.

Who is affected

Anyone who has clicked “Allow” on a website notification prompt could receive these messages. The reported campaigns included deceptive quiz pages and attention-grabbing articles shown to Android and Chrome users through Google Discover.

Allowing notifications does not install malware by itself. The danger begins when a person trusts an alert, opens its link or downloads something it promotes. The source did not disclose a complete list of affected websites, browsers or devices.

What to do now

1. Do not open a frightening notification. Ignore links claiming that your device has a virus, a payment is overdue, you face legal trouble or a family member is calling. A browser alert is not proof that any of those claims are real.

2. Use Chrome’s built-in control on supported Android devices. When the unwanted notification appears, select Unsubscribe if that option is available. Use this browser control instead of a link inside the suspicious message.

3. Block the site manually if Unsubscribe is missing. In Chrome on Android, open More > Settings > Site settings > Notifications. Review the websites under the allowed list and block the one sending the alerts.

4. Check notification permissions when scans find nothing. If repeated warnings continue but a malware scan is clean, inspect the browser’s list of allowed websites. Remove permission from any site you do not recognize or no longer trust.

5. Treat future permission prompts as ongoing access. Select Allow only when you genuinely want continuing messages from that website. A quiz, article or video should not need notification access merely to display its content.