ALT: somebody better call an exorcist

Cet article présente les nouvelles capacités de détection côté client intégrées à Microsoft Edge pour contrer l'abus des notifications de navigateur à des fins malveillantes. Des escrocs exploitent le mécanisme légitime de notifications web des navigateurs pour diffuser de fausses alertes de virus et des arnaques de type scareware.

Website notifications were designed to help us stay informed. They can alert you to a new message, remind you of an upcoming event, or share an important update from a service you trust. But scammers...

Website notifications were designed to help us stay informed. They can alert you to a new message, remind you of an upcoming event, or share an important update from a service you trust. But scammers...

Microsoft has highlighted how the Scareware blocker feature protects users from falling prey to fake notification scams/phishing attempts.

Windows Blogs: Website notifications were designed to help us stay informed. They can alert you to a new message, remind you of an upcoming event, or share an important update from a service you trust...

Microsoft Edge now automatically disables notifications from websites that send users to detected scam pages, cutting off a route used to deliver fake virus warnings. The protection connects Microsoft Defender SmartScreen and Scareware blocker detections with notification permissions, helping prevent malicious sites from repeatedly drawing people back into the same scam. The change arrived with Edge 156, according to Microsoft’s November 2 disclosure. Rather than simply warning about a dangerous destination, Edge can now stop further notifications from the website responsible for sending the user there. That distinction matters because closing a deceptive page does not necessarily stop notifications the visitor previously allowed. Researchers writing on Windows Blogs, Rob Franco and Lu Huang, noted the malicious notification abuse while reviewing user reports submitted through Scareware blocker. Their findings describe a recurring scam delivery method, not a newly named malware family: website notifications repeatedly brought users back to pages that Edge’s security tools identified as scams. Microsoft Edge Now Automatically Blocks Malicious Websites The attack starts with a permission request. A misleading website persuades someone to select “Allow,” sometimes claiming this is necessary to prove they are not a robot. That click grants notification access, giving the site repeated opportunities to display false security messages even after the original page has closed. These alerts borrow the language of antivirus products to create urgency. Related reporting on fake Microsoft security scans shows how convincing branding and fabricated findings can pressure users into unsafe decisions. Say yes once and fake alerts can start piling up (Source – Windows) A notification claiming that a computer is infected should therefore not be confused with a verified diagnosis from installed security software. Edge’s new response follows a specific detection chain. When Microsoft Defender SmartScreen or Scareware blocker identifies a scam reached through a notification, the browser automatically disables notifications from the originating site. This closes the route used to bring the user back, rather than addressing only the page currently open. The scope is important: Microsoft describes notification blocking tied to detected scams, not a guarantee that every deceptive website will be stopped before interaction. On the next browser launch, an information bar explains the action. Users can review blocked sites in Edge Settings and restore notifications if they believe the browser made an incorrect decision. The wider scam ecosystem explains why stopping repeat contact matters. Campaigns using the browser locking CypherLoc kit have combined full-screen warnings, hidden controls and alarming sounds to push fake Microsoft support calls. Those techniques are separate from notification permissions, but both depend on making a browser message look like a serious system emergency. Microsoft says Scareware blocker directly protects tens of thousands of users daily against new scams. Reports also support wider SmartScreen protection; during the preview, each report helped protect another 50 users. The new notification control extends that feedback process by acting on the delivery source as well as the destination. Reporting Suspicious Prompts and Stopping Repeat Scams Edge also offers a “Block and report” option within notification permission requests. Users can open the menu beside “Block” and report the requesting site before granting access. Reports can include the URL and a screenshot of the page that tried to persuade the visitor to enable notifications. This gives SmartScreen evidence earlier in the process, potentially before an abusive notification reaches anyone. The distinction between delivery and deception is also visible in malicious Google Ads campaigns that lead visitors to fake security warnings. Different entry points can feed similar support scams, making the original source worth investigating alongside the warning itself. The settings page lists the blocked site and lets you unblock to restore its notifications (Source – Windows) Users retain a manual way to stop unwanted messages when automatic detection does not intervene. Microsoft advises opening the “…” menu on a website notification and disabling future notifications from that site. Other buttons inside a fake alert may simply open more pop-up windows, so interacting with its supposed repair controls can prolong the scam. For security teams, the practical value is a shorter repeat-exposure window. Blocking a detected destination helps with one encounter; withdrawing the sender’s notification access also interrupts future attempts from that source. Microsoft describes the broader approach as connecting browser-side detection, user reports and cloud reputation to turn individual observations into protection for more users. Indicators of compromise (IoCs):- Indicator type Source disclosure Malicious domains, URLs and IP addresses Not provided SHA-256, SHA-1 and MD5 hashes Not provided Named malware family Not identified Note:   IP addresses and domains are intentionally Qdefanged (e.g.,  [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM . Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs . The post Microsoft Edge Now Automatically Blocks Malicious Websites Sending Fake Virus Alert Notifications appeared first on Cyber Security News .

Microsoft Edge 156で悪質なWeb通知の自動停止機能が導入。SmartScreenやScareware blockerが通知経由の詐欺を検知すると、通知元サイトの権限を無効化します。Microsoftの一次資料から「ブロックして報告」、設定方法、企業向け通知ポリシーを解説

Der Webbrowser Microsoft Edge hat einen erweiterten Schutzmechanismus gegen sogenannte Scareware erhalten. Die neue Schutzfunktion schaltet Website-Benachrichtigungen künftig automatisch ab, sobald diese zur Verbreitung gefälschter Virenmeldungen oder betrügerischer Inhalte missbraucht werden. Damit reagiert der Softwarekonzern auf Angriffswellen, bei denen manipulierte Browser-Hinweise Anwender fortlaufend auf unseriöse Internetangebote locken. Automatische Abschaltung bei betrügerischen Push-Nachrichten Viele Online-Betrugsmaschen beginnen […] The post Microsoft Edge 156: Browser sperrt betrügerische Benachrichtigungen automatisch appeared first on BornCity.

To celebrate Halloween I'm playing 6 obscure indie horror games you've never heard of in the first annual Scareware! While playing these scary indie games I also have to leave an honest positive…

Microsoft Edge now goes after a less obvious part of scareware scams: the notification permission that keeps sending people back to a scam page. In a November 2, 2026 Edge blog post by Rob Franco,…

ALT: Father Mulvehill's Exorcism: The Power of Christ

ALT: