Random Chrome Notifications and Strange Source Code

Question

My elderly parents are receiving chrome notifications from a strange URL on their iMac: (https://s1.snc.com.ru:443)

Example Messages

• Pending Payment: Paypal Has Sent You $65,900

• Clean your mac. Do not ignore this message.

I've remotely connected and scanned with Malwarebytes & Avast, but have found no threats.

I didn't see any issues when checking the URL on VirusTotal either. Visiting the URL renders a progress bar made with Bootstrap/Javascript and asks for permission to give notifications. Of course, I click no/block. There's some interesting javascript in the sourcecode that has a couple other URLS.

I've just blocked the notifications for now, but I'm really curious; what is this? Did I screw up by visiting the URL?

Answer 1

The site asks permission to send Web Push Notifications. That's not technically a malware and won't get detected as such. The site is just using this permission in a malicious way by sending these spam messages. That's pretty common.

• Malwarebytes: Browser push notifications: a feature asking to be abused

• Sites Trick Users Into Subscribing to Browser Notification Spam

  To remove them in Chrome, you can go into the Settings and search for Notifications, click on Content Settings, and then click on Notifications. Chrome will now display a list of sites that you are subscribed to or have blocked.

You must teach your parents some basic rules on the Internet: Don't click yes on everything. By default, select no if you don't understand the question. You could also tweak their browser to help them with this task:

• Disabled web push notifications altogether by selecting Do not allow any site to show notifications from the Content Settings.
• You could also disable location by selecting Do not allow any site to track your physical location.
• Revise all Content Settings and disable everything your parents won't actually need.