Customers reported intrusive browser notifications that Malwarebytes scans did not detect because the alerts were web push notifications granted by deceptive websites rather than malware on their devices. These campaigns used quiz and fake extension sites to trick users into clicking “Allow,” with domains such as triviabox[.]co.in and unsphiperidion[.]co.in enabling persistent ad, affiliate, and scam notifications #triviabox #unsphiperidion
Keypoints
- Multiple customers reported apparent “malware” notifications, but Malwarebytes scans were clean because the alerts were browser push notifications, not device infections.
- Attackers used deceptive sites (quiz sites and fake extension update prompts) to bait users into clicking “Allow” on the browser’s notification permission dialog.
- Common domains involved include triviabox[.]co.in and unsphiperidion[.]co.in, among an 18-domain network tied to the campaign.
- Once allowed, sites can send persistent notifications even when the browser is closed, delivering ads, affiliate schemes, scams, or unwanted downloads.
- Browsers provide ways to block or remove these notifications; guidance is provided for Chrome, Firefox, Opera, Edge, and Safari (macOS and Android distinctions noted).
- Prevention advice: avoid clicking “Allow” on unexpected prompts, use the notifications gear icon to identify and block offending sites, and consider disabling notification requests entirely.
MITRE Techniques
- No MITRE ATT&CK techniques were explicitly mentioned in the article.
Indicators of Compromise
- [Domain ] deceptive quiz and fake extension sites used to request notification permissions – triviabox[.]co.in, unsphiperidion[.]co.in, and 16 other domains (e.g., dailyrumour[.]co.nz, quizcentral[.]co.in)