Cybersecurity researchers have uncovered a new ad fraud scheme that uses search engine poisoning (SEO) techniques and artificial intelligence (AI)-generated content to push deceptive news articles into Google’s Discover feed and trick users into enabling persistent browser notifications that lead to scareware and financial fraud.
The campaign was found targeting Android and Chrome users’ personalized content feeds and was codenamed “Pushpaganda” by HUMAN’s Satori threat intelligence and research team.
“The operation, named after the push notifications at the heart of the scheme, generates invalid organic traffic from real mobile devices by tricking users into registering to enable notifications that present warning messages,” researchers Luisa Abel, Vikas Parthasarati, João Santos, and Adam Sell said in a report shared with Hacker News.
At its peak, approximately 240 million bid requests over a seven-day period were associated with 113 domains linked to campaigns. The threat was observed targeting India, but has since spread to other regions, including the US, Australia, Canada, South Africa, and the UK.
Gavin Reid, chief information security officer at HUMAN, said the findings show how threat actors are exploiting AI to hijack trusted discovery surfaces and turning them into delivery vehicles for scareware, deepfakes and financial fraud. Google has since released a fix to address the spam issue.
The entire scheme relies on scammers luring unsuspecting users through Google Discover into accessing misleading news articles filled with AI-generated content. When users visit one of the attacker-controlled domains, they are forced to enable push notifications that deliver fake legal threats and scams.
Specifically, clicking on a scareware notification redirects users to additional sites operated by threat actors, generating organic traffic to ads embedded on those sites and generating illicit revenue.
This isn’t the first time attackers have weaponized push notifications and redirected them to creepy websites. In September 2025, Infoblox uncovered a threat actor known as Vane Viper that was systematically exploiting push notifications to serve ads and facilitate ClickFix-style social engineering campaigns.
“Malware-based threats with push notifications are not a new threat on both web and mobile platforms, especially given the way they create a sense of urgency and urgency,” Lindsay Kay, vice president of threat intelligence at HUMAN Security, told The Hacker News. “Users often click quickly to leave or get more information, making it an effective tool in a malware author’s arsenal.”
This disclosure also comes a little more than a month after HUMAN identified a collection of over 3,000 domains and 63 Android apps that constitute one of the largest ad fraud laundering markets ever discovered. This operation, known as Low5 due to its use of HTML5-based gaming and news sites, has been found to monetize domains as cashout sites for sophisticated fraud schemes such as BADBOX 2.0.
“At its peak, this operation reached approximately 2 billion bid requests per day and may have operated on up to 40 million devices worldwide,” the company said. “Apps associated with Low5 contain code that instructs a user’s device to visit one of the domains associated with the scheme and click on an ad found there.”
Cashout sites, also known as ghost sites, are used to commit content-driven fraud. Attackers use fake sites and apps to sell space to advertisers who assume their ads will be viewed by humans. The Android app in question has been removed from the Google Play Store.
“A shared monetization layer across over 3,000 domains allows multiple threat actors to connect to the same infrastructure, creating a distributed laundering system that increases threat resiliency, complicates attribution, and enables rapid replication,” HUMAN added.
“A key takeaway from this research is that monetization infrastructure can survive even after a particular fraudulent campaign is shut down. Even if one malicious app or device network is removed, the same cashout domain can be reused by other attackers. Low5 reinforces the need for ongoing, proactive threat intelligence and detection expertise to seek out cashout domains and flag them before bidding.”
Source link
