Fraudulent browser push notifications as a means of phishing and advertising are gaining popularity, with the share of users hit by the problem growing month-on-month this year.
As shown by recent Kaspersky research, the monthly number of users affected has grown from 1,722,545 in January to 5,544,530 in September2019. In total, during the first nine months of 2019, Kaspersky products protected more than 14 million of users from attempts to allow websites to show unwanted notifications. With essentially every web user being a potential victim, this threat, although unsophisticated, requires additional attention.
Since a user’s consent is required in order to start sending notifications, attackers have come up with multiple, often ‘out of the box’ ways to trick and force people to sign up for subscriptions. The detected options include:
- Passing subscription consent off as another action, such as a CAPTCHA
- Switching the ‘accept’ and ‘decline’ buttons on subscription alerts mid-action
- Showing notifications from phishing copies of popular websites
- Showing fraudulent subscribe pop-ups on websites
Number ofKaspersky products users that have been hit by ad and scam push notifications, January– September2019
After gaining user’s consent, attackers start bombarding them with messages. The least harmful (and yet the most popular) options are clickbait ads on sensitive social topics, while others include scam notifications – like lottery wins, offers of money in exchange for completing a survey or something similar. Schemes that are more sophisticated are targeted at milking money out of users using phishing techniques.
An example of a phishing notification impersonating a Microsoft Windows system update
A common scheme uses messages disguised as system notifications, such as virus infection alerts. These redirect users to phishing copies of trusted websites and then prompt users to download various paid “PC cleaning” utilities. However, the potential of push notifications being used for such scams is not limited to just that.
To avoid receiving annoying notifications or scam ads, users can follow a few simple recommendations:
- Where possible, block all subscription offers, unless they come from popular and trusted websites. Remain vigilant to ensure you are not redirected to a fake website.
- If unable to avoid an unwanted subscription, block it in the browser settings.
- Start using a reliable security solution, like Kaspersky Security Cloud, that blocks ad and scam push subscription offers in browsers, can delete subscriptions that have already been approved, and has an anti-phishing feature.
Read more on the topic in the Kaspersky Unwanted notifications report on Securelist.
