Pushpaganda abuses browser alerts to spread scams and ads

Two investigations into deceptive web prompts show how simply granting a browser notification can turn a short visit into ongoing advertising and fraud opportunities for scammers. Malwarebytes’ own research into deceptive quiz sites found that users are first prompted with a standard browser notification permission, but the site then instructs “Click ‘Allow’ to continue,” effectively tying the action to further alerts.

HUMAN Security’s Satori team later highlighted an operation dubbed Pushpaganda, which spread sensational, AI‑generated content through Google Discover feeds to Android and Chrome users. Once a site is visited, the push notification stream that follows can bear little relation to the article that attracted the user, with examples including fake arrest warrants, false financial alerts, and messages appearing to come from family members.

At its peak, researchers say Pushpaganda involved roughly 240 million advertising bid requests in seven days, with winning ads delivered as notifications to those who had granted permission. The campaigns demonstrate multiple advantages for scammers: repeated return visits, a more credible “security alert” veneer, and the ability to distance the user from the original prompt.

The article notes that while allowing notifications does not install malware, it facilitates deception that can lead to harmful clicks or downloads. Practical steps outlined include only enabling alerts from sites you trust, and using browser controls to review or revoke site permissions; detailed Android Chrome guidance and a reminder that Unsubscribe options can exist within notifications.