Push notification scams: why sites ask you to click Allow

Malwarebytes reported that scammers are using browser permissions to keep contacting people after they leave a site, a tactic now called push notification scams. The trick shows up on quiz pages and sensational articles that prompt the browser permission request while telling you to click Allow to continue. Once authorized, the sites can send alerts that impersonate security warnings, missed payments, or calls from family members, and those messages can keep appearing even when you are not visiting the site, Malwarebytes found.

How push notification scams work

Malwarebytes describes two related patterns. In one, quiz and clickbait pages bring up the browser notification permission while an on-page message instructs visitors to “Click 'Allow' to continue.” The page makes it look like the permission is needed for the quiz or content when it actually signs the visitor up to receive future notices.

HUMAN Security's Satori researchers observed a larger operation they named Pushpaganda, where sensational articles and likely AI-generated images drew readers via Google Discover into pages that asked for notification permission. After someone granted it, the notifications that followed often had nothing to do with the article that brought them there. Researchers reported messages that mimicked arrest warrants, false financial alerts, or missed calls from contacts, and they observed those placements reaching Android and Chrome users.

Malwarebytes and HUMAN Security note a practical advantage for criminals: a granted notification permission is a way to reach someone repeatedly, long after the original visit. Depending on the device and browser settings, those notifications can appear even when the browser is not visibly open. That gives scammers several benefits: multiple opportunities to get clicks, more convincing channels to display false claims, and distance from the site that originally asked for permission.

Why this matters for small businesses and nonprofits

If one of your staff or volunteers gives a notification permission to a deceptive site, they may later see alarming messages that look like they come from legitimate services or from people they know. Those alerts can send traffic to affiliate offers, ads, or scam pages, and they can prompt people to download unwanted software or give up personal information. Allowing notifications does not mean a device is infected, Malwarebytes found, which is why scans can come up clean while the alerts keep arriving.

That background also means your organization could be targeted indirectly: a staff member who follows a suspicious alert back to a site might expose credentials or download something, or they could forward an alarming notification to others inside an organization. Treat these alerts with caution and handle them as you would any suspicious message.

How to spot and stop these alerts, right now

Follow these practical steps, based on the controls Malwarebytes describes:

• Don’t click notification prompts until you know what they will do; treat “Allow notifications to continue” as a red flag, especially on quizzes, video pages, or unfamiliar sites.
• Use browser and web protection tools to block malicious sites; Malwarebytes recommends its Browser Guard as one option.
• If you get an unwanted website notification on supported Android Chrome, swipe down to open the notification shade and look for an Unsubscribe action on the alert, then tap Unsubscribe to stop future messages from that site.
• If Unsubscribe is not available, open Chrome and go to More > Settings > Site settings > Notifications, review allowed sites, and block the offending site. You do not need to tap any link inside a suspicious notification to manage or revoke its permission.
• Review who in your organization has permission to install browser extensions or make browser setting changes, and remind staff not to follow links in alarming notifications.

What to watch for when investigating alerts

Malwarebytes notes that the notifications often impersonate familiar services or people, so do not assume an alert is genuine just because it looks official. If a device scan shows no malware but alarming messages keep appearing, check the browser notification permissions and the list of allowed sites before doing anything that the alert asks you to do. For Android users, the Chrome Unsubscribe option is a fast first response. For other browsers, go into site notification settings and remove the permit.

HUMAN Security's research also showed the problem can scale through ad systems. Their Satori team saw a very large number of advertising bid requests tied to Pushpaganda domains during the campaign peak, illustrating that these messages can be distributed broadly through ad networks once criminals have built the infrastructure.

If your organization wants help

If you want to know what an attacker can already learn about your website, Jones Web Designs has a short checklist and services that include security testing and basic hardening. See our page on website security: /security.html.

In summary, the immediate risk is not a hidden infection, it is the permission you granted. Treat browser notification prompts like any other permission request: ask whether you want ongoing messages from that site, and if the answer is no, deny the request and remove any accidental allows from your browser settings. Malwarebytes and HUMAN Security's findings underscore that attention is valuable to scammers, and that a single click on Allow can create repeated opportunities to trick you.