Browser Push Notification Scams Are on the Rise

July 23, 2026 - 02:00

A growing wave of cyberattacks is exploiting a feature most people ignore: browser push notifications. Scammers are now using these alerts to deliver fake security warnings that look like they come from trusted antivirus software or operating systems. The goal is to trick users into clicking, which can lead to malware infections or financial theft.

The scheme works simply. A user visits a compromised website, often a streaming site or a page offering free downloads. A pop-up asks if they want to allow notifications. If they click "allow," the site gains permission to send alerts directly to their desktop or phone. Later, the victim receives a notification claiming their computer is infected. The message urges them to call a fake support number or download a "fix" that is actually malicious software.

These scams are effective because they bypass traditional email filters and appear on the user's screen like a legitimate system message. Many people assume the alert comes from their own device, not from a website they visited weeks ago.

To protect yourself, never click "allow" on notification requests from unfamiliar sites. If you have already allowed notifications from a suspicious source, go into your browser settings and revoke permission for that site. Legitimate security alerts never appear as browser notifications. If you see one, close the browser tab without clicking anything. Running a trusted antivirus scan is a safer step than trusting a pop-up warning.