Client-side threat detection: how Scareware blocker uncovered malicious notification abuse

Website notifications were designed to help us stay informed. They can alert you to a new message, remind you of an upcoming event, or share an important update from a service you trust.

But scammers are turning this useful browser feature into a persistent channel for fake virus warnings, security alerts, and other scams. They take advantage of our busy lives to persuade us to allow notifications from malicious sites. Selecting “Allow” can give a malicious site repeated opportunities to send fake virus warnings and deceptive security alerts. Even after you close the original page, notifications can lead back to the scam again and again.

Edge has been fighting notification spam for years and there are multiple workstreams actively detecting and blocking them by the billions. But now we’re improving protections using intelligence in the Edge browser and making it easier to report scams.