Loading story…
Researchers said a threat operation dubbed Pushpaganda manipulated Google Discover on Android and Chrome to lure users into enabling malicious browser push notifications. The campaign relied on 113 actor-controlled domains publishing AI-generated, sensational news pages that mimicked legitimate content and used social-engineering themes including fake government deposits, tax notices, arrest warrants, missed calls, and bank alerts. HUMAN’s Satori Threat Intelligence and Research Team reported the activity first focused on India before expanding to Australia, the United States, and other regions.
Once users landed on the pages, deceptive prompts and buttons pushed them to subscribe to notifications, while JavaScript-based tab rotation opened additional domains to inflate traffic and advertising revenue. At its peak, the operation generated roughly 240 million bid requests in seven days, indicating a large-scale ad fraud component alongside the notification abuse. Researchers shared the infrastructure with Google, which said it deployed a fix to prevent this type of manipulative low-quality content from appearing in Discover feeds.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Google said it deployed a fix to prevent this type of manipulative low-quality content from appearing in Discovery feeds. The action was taken in response to the campaign's abuse of Google Discover to drive malicious notification subscriptions and ad fraud.
HUMAN researchers shared the malicious domains associated with Pushpaganda with Google after identifying the campaign's abuse of Google Discover and browser notification prompts. This disclosure supported mitigation of the manipulation technique.
At its peak, the operation generated about 240 million bid requests in a seven-day period while using deceptive buttons and JavaScript-based tab rotation to open extra domains, inflate traffic, and produce fraudulent advertising revenue. Researchers linked the activity to 113 actor-controlled domains.
After initially targeting India, the Pushpaganda operation broadened its activity to Australia, the United States, and additional countries. The campaign used social-engineering lures such as fake government deposits, tax notices, arrest warrants, missed calls, and bank alerts.
HUMAN's Satori Threat Intelligence and Research Team identified a threat operation dubbed Pushpaganda that used actor-controlled domains and AI-generated sensational news pages in Google Discover to trick users into enabling malicious browser push notifications. The campaign initially focused on users in India before later expanding to other regions.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcehumansecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Infoblox researchers** reported that a large-scale scam push-notification operation targeting primarily **Android Chrome** users was partially exposed after the threat actor made a **DNS configuration error** that left domains in a **lame delegation** state (a “**Sitting Ducks**” condition). By legitimately re-claiming an abandoned actor-controlled domain at its DNS provider—without accessing victim devices or the attacker’s servers—the researchers redirected notification and tracking traffic to infrastructure they controlled, gaining a live view of the criminal ecosystem behind the deceptive browser-notification spam. Telemetry collected from victim browsers included rich JSON-style request data (e.g., device and locale details, lure text, and click behavior) and showed sustained, high-volume abuse: users could receive **100–140+ notifications per day** for extended periods, with lures ranging from fake security alerts to gambling and adult content. Reporting indicates the researchers expanded collection from a single domain to **nearly 120 domains**, capturing **tens of millions of records** (including a cited figure of **~57 million logs over two weeks**) and observing global activity across **60+ languages**, with traffic heavily concentrated in **South Asia** (notably Bangladesh, India, Indonesia, and Pakistan).
Jun 29, 2026
HUMAN's Satori Threat Intelligence and Research Team disclosed an Android ad fraud and malvertising operation dubbed **Trapdoor** that relied on **455 malicious apps** and **183 threat actor-controlled command-and-control domains**. The apps were disguised as common utilities such as PDF readers, file managers, and device cleanup tools, then prompted users to install fake software updates or secondary apps. Those follow-on payloads used hidden embedded browsers and WebViews to load malicious HTML5 content in the background, generating fraudulent ad impressions, clicks, and bid requests without the victim's knowledge. Researchers said the scheme was effectively self-funding, turning seemingly legitimate installs into an illicit advertising revenue loop that financed further malvertising. At its peak, Trapdoor generated up to **659 million bid requests per day** and was tied to more than **24 million fraudulent app installs**. The malware also used install attribution services and download-origin checks to activate malicious behavior mainly for users acquired through the actors' own ad campaigns while suppressing activity for organic installs, helping it evade detection. Most observed traffic came from the United States, with additional activity seen in Japan, Australia, Russia, New Zealand, India, and elsewhere; after responsible disclosure, Google removed the identified apps from Google Play.
Jun 29, 2026
Threat actors are exploiting browser push notifications as a novel vector for fileless, cross-platform phishing attacks using a new command-and-control (C2) platform called Matrix Push C2. This framework leverages social engineering to trick users into granting notification permissions on either malicious or compromised legitimate websites. Once access is granted, attackers send notifications that mimic trusted system or browser alerts, often impersonating brands like Cloudflare, PayPal, or Google Chrome, to lure victims into clicking links that redirect to phishing or malware sites. The entire attack chain operates within the browser, bypassing traditional security controls and requiring no initial malware infection, making it effective across all operating systems. Matrix Push C2 is marketed as a malware-as-a-service (MaaS) kit, sold via cybercrime forums and Telegram, and provides a dashboard for attackers to manage campaigns, customize notification content, and track victim interactions. Features include analytics on delivery and click rates, victim system details, and the ability to impersonate various brands. The service's fileless nature and cross-platform reach make it a significant threat, as it enables persistent communication with compromised users and circumvents common email-based security defenses. Security researchers warn that this approach could see increased adoption due to its effectiveness and ease of use for cybercriminals.
Jun 29, 2026