Quiz Sites Trick Users into Enabling Unwanted Browser Notifications

Quiz Sites and Browser Notifications 🚨

Our support team flagged several customers who suspected their devices might be infected with malware, but Malwarebytes scans came up empty. When the customers provided screenshots, our Malware Removal Support team quickly recognized the format as web push notifications. These notifications aren’t malware on the device; they’re browser notifications from websites that trick users into clicking “Allow.”

The Deceptive Process 🔍

Many users were unaware of how they ended up with these notifications. A domain called triviabox[.]co[.]in led us to the source. We discovered a site that challenged our intelligence with quizzes on geography, vocabulary, and history, specifically targeting users from Canada, Germany, France, Japan, and the US. The main goal of these sites is to get users to click the “Start the quiz” button, allowing the site to send notifications later and profit from ads, affiliate schemes, scams, or unwanted downloads.

The Misleading Prompts ⚠️

Before starting the quiz, visitors are shown a prompt with a misleading background. The text urging users to allow notifications reveals the true intention. By clicking “Allow,” users grant the website permission to show notifications even when they’re not on the site, making it difficult to trace the origin. The “Click Allow to continue” text is merely a lure to get users to open the floodgates.

Stay Safe! 🛡️

Web push notifications can be more than just simple advertisements; some may contain misleading messages about your computer’s safety. We often find them used by affiliates to promote security software.

The gear icon in the notifications can be very helpful. On Chromium-based browsers, clicking it leads to the Notifications settings menu where you can block them. Web push notifications can disturb users across various platforms, including Android, Chromebook, MacOS, and Linux, as long as they use participating browsers like Chrome, Firefox, Opera, Edge, and Safari. In some cases, notifications can appear even when the browser is closed.

Be cautious and think twice before clicking “Allow.” During our investigation, we found and blocked several domains related to this campaign, including: dailyrumour[.]co.nz, edifaqe[.]org, geniusfun[.]co.in, and many more.

For more details, check out the full article: Read full article