Browser notification abuse redirects to suspicious sites
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Attackers abuse browser push notifications to display fake security warnings and redirect users to malicious sites.
Attackers are exploiting browser notification features to display fake alerts claiming devices are infected or need cleanup. The attack begins when users visit a compromised or attacker-controlled website that requests browser notification permission, often disguised as a CAPTCHA verification to trick users into clicking "Allow." Once permission is granted, the attacker can send unsolicited notifications to the victim's browser at any time. These notifications contain false claims (e.g., "Your computer has a virus," "Clean up your smartphone") and impersonate security vendors or Windows branding to create urgency. Clicking the notification redirects users to malicious sites distributing fake security software, fake prize/lottery pages, or suspicious mobile applications. The technique affects Windows and Android devices; iOS devices are not vulnerable as Safari does not support web push notifications. Users who click through may suffer financial loss through fake software purchases, credential theft, or malware installation.
Detection guidance
Browser Policy Forcing Web Notifications Allowed
Detects Chrome or Edge policy registry values that allow web notifications by default or for specific sites, written by a process other than Group Policy, which lets push-notification scam pages reach users without a prompt. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Browser Policy Forcing Web Notifications Allowed
description: Detects Chrome/Edge policy registry values that allow web notifications
by default or for named sites (DefaultNotificationsSetting=1, NotificationsAllowedForUrls)
being written by a process other than Group Policy processing. Attackers or adware
can use this to enable push-notification scam delivery without user consent prompts.
tags:
- attack.initial-access
- attack.t1189
- attack.t1566.002
logsource:
category: registry_set
product: windows
detection:
selection_default:
TargetObject|contains:
- \Policies\Google\Chrome\DefaultNotificationsSetting
- \Policies\Microsoft\Edge\DefaultNotificationsSetting
Details|contains: DWORD (0x00000001)
selection_allowlist:
TargetObject|contains:
- \Policies\Google\Chrome\NotificationsAllowedForUrls\
- \Policies\Microsoft\Edge\NotificationsAllowedForUrls\
filter_gpo:
Image|endswith: \svchost.exe
condition: 1 of selection_* and not filter_gpo
falsepositives:
- Administrators or endpoint management agents deploying browser policies that allow
notifications for an internal web application
- Software installers that configure Edge or Chrome policies
level: medium
id: 945e3663-7034-5aed-96df-3a3f44d4f8d8
status: experimental
author: Vorant
references:
- https://www.ipa.go.jp/security/anshin/attention/2021/mgdayori20210309.html
Browser Launched From Web Notification Click
Detects Chrome or Edge started with --notification-launch-id, which happens when a web push notification is clicked while the browser is closed. Hunting rule to surface notification-driven redirects. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Browser Launched From Web Notification Click
description: Detects Chromium-based browsers started with the --notification-launch-id
argument, which happens when a user clicks a web push notification while the browser
is not running. Useful as a hunting signal for notification-abuse scams that redirect
to fake security alerts or prize pages; correlate with subsequent browser network
activity.
tags:
- attack.initial-access
- attack.t1189
- attack.t1566.002
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \chrome.exe
- \msedge.exe
- \brave.exe
- \opera.exe
- \vivaldi.exe
CommandLine|contains: --notification-launch-id
condition: selection
falsepositives:
- Legitimate web apps such as webmail or chat whose notifications the user has allowed
and clicks while the browser is closed
level: low
id: 7a1bb1cf-19f4-54e2-8331-cd7b11589880
status: experimental
author: Vorant
references:
- https://www.ipa.go.jp/security/anshin/attention/2021/mgdayori20210309.html
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/anshin/attention/2021/mgdayori20210309.html
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs