Pushpaganda Abused Google Discover to Drive Malicious Browser Notifications

Researchers said a threat operation dubbed Pushpaganda manipulated Google Discover on Android and Chrome to lure users into enabling malicious browser push notifications. The campaign relied on 113 actor-controlled domains publishing AI-generated, sensational news pages that mimicked legitimate content and used social-engineering themes including fake government deposits, tax notices, arrest warrants, missed calls, and bank alerts. HUMAN’s Satori Threat Intelligence and Research Team reported the activity first focused on India before expanding to Australia, the United States, and other regions.

Once users landed on the pages, deceptive prompts and buttons pushed them to subscribe to notifications, while JavaScript-based tab rotation opened additional domains to inflate traffic and advertising revenue. At its peak, the operation generated roughly 240 million bid requests in seven days, indicating a large-scale ad fraud component alongside the notification abuse. Researchers shared the infrastructure with Google, which said it deployed a fix to prevent this type of manipulative low-quality content from appearing in Discover feeds.