Microsoft Edge Blocks Fake Virus Alerts by Disabling Malicious Site Notifications
Microsoft Edge now automatically blocks fake virus alert notifications from malicious websites by disabling the site's notification permissions, enhancing protection against common scam tactics.
Microsoft Edge has introduced a new security feature that automatically disables notification permissions for websites identified as scams, effectively cutting off a primary vector for fake virus alerts and other deceptive content. This enhancement, integrated with Microsoft Defender SmartScreen and the Scareware blocker, aims to prevent malicious sites from repeatedly harassing users even after they have closed the initial deceptive page.
The attack vector typically begins with a misleading website prompting users to grant notification permissions, often under the guise of verifying they are not a robot. Once granted, these sites can persistently display alarming messages, mimicking legitimate security software, to pressure users into unsafe actions. Even after the user navigates away from the initial page, the granted notification permissions allow the scam to continue its barrage.
With the rollout of Edge version 156, the browser now takes a more proactive stance. Instead of merely warning users about a dangerous destination, Edge can now revoke a site's ability to send further notifications if that site is flagged by its security tools. This is a crucial distinction, as simply closing a malicious tab does not automatically revoke previously granted notification privileges.
When Microsoft Defender SmartScreen or Scareware blocker detects a scam that was accessed via a notification, Edge automatically intervenes by disabling notifications from the originating website. This action targets the source of the repeated harassment, not just the immediate page the user is viewing. An information bar appears on the next browser launch, explaining the action taken and allowing users to review and manually re-enable notifications if they believe the blocking was an error.
This new protection is part of a broader effort to combat the ecosystem of online scams. Threat actors often employ a combination of techniques, including fake security warnings, browser locking, and alarming sounds, to create a sense of urgency and panic. While these methods differ from notification abuse, they share the common goal of making a browser-based message appear as a critical system emergency.
Microsoft highlights that the Scareware blocker alone protects tens of thousands of users daily, and the new notification control extends this protective feedback loop. By acting on the delivery source as well as the destination, Edge aims to disrupt the cycle of repeated exposure to malicious content.
Furthermore, Edge offers users an additional layer of defense through a "Block and report" option directly within notification permission requests. This allows users to report a suspicious site before granting any permissions, providing valuable early intelligence to SmartScreen. This proactive reporting mechanism helps to identify and neutralize abusive notification practices before they can affect a wider audience.
The practical benefit for users and security teams is a significantly reduced window of exposure to repeat scam attempts. By blocking a detected malicious destination and revoking its notification privileges, Edge disrupts the persistent nature of these attacks, reinforcing its commitment to user safety in an increasingly complex threat landscape.