Microsoft Edge Now Automatically Blocks Malicious Websites Sending Fake Virus Alert Notifications

Microsoft Edge now automatically disables notifications from websites that send users to detected scam pages, cutting off a route used to deliver fake virus warnings.

The protection connects Microsoft Defender SmartScreen and Scareware blocker detections with notification permissions, helping prevent malicious sites from repeatedly drawing people back into the same scam.

The change arrived with Edge 156, according to Microsoft’s November 2 disclosure. Rather than simply warning about a dangerous destination, Edge can now stop further notifications from the website responsible for sending the user there.

That distinction matters because closing a deceptive page does not necessarily stop notifications the visitor previously allowed.

Researchers writing on Windows Blogs, Rob Franco and Lu Huang, noted the malicious notification abuse while reviewing user reports submitted through Scareware blocker.

Their findings describe a recurring scam delivery method, not a newly named malware family: website notifications repeatedly brought users back to pages that Edge’s security tools identified as scams.

Microsoft Edge Now Automatically Blocks Malicious Websites

The attack starts with a permission request. A misleading website persuades someone to select “Allow,” sometimes claiming this is necessary to prove they are not a robot.

That click grants notification access, giving the site repeated opportunities to display false security messages even after the original page has closed.

These alerts borrow the language of antivirus products to create urgency. Related reporting on fake Microsoft security scans shows how convincing branding and fabricated findings can pressure users into unsafe decisions.

A notification claiming that a computer is infected should therefore not be confused with a verified diagnosis from installed security software.

Edge’s new response follows a specific detection chain. When Microsoft Defender SmartScreen or Scareware blocker identifies a scam reached through a notification, the browser automatically disables notifications from the originating site.

This closes the route used to bring the user back, rather than addressing only the page currently open. The scope is important: Microsoft describes notification blocking tied to detected scams, not a guarantee that every deceptive website will be stopped before interaction.

On the next browser launch, an information bar explains the action. Users can review blocked sites in Edge Settings and restore notifications if they believe the browser made an incorrect decision.

The wider scam ecosystem explains why stopping repeat contact matters. Campaigns using the browser locking CypherLoc kit have combined full-screen warnings, hidden controls and alarming sounds to push fake Microsoft support calls.

Those techniques are separate from notification permissions, but both depend on making a browser message look like a serious system emergency.

Microsoft says Scareware blocker directly protects tens of thousands of users daily against new scams. Reports also support wider SmartScreen protection; during the preview, each report helped protect another 50 users.

The new notification control extends that feedback process by acting on the delivery source as well as the destination.

Reporting Suspicious Prompts and Stopping Repeat Scams

Edge also offers a “Block and report” option within notification permission requests. Users can open the menu beside “Block” and report the requesting site before granting access.

Reports can include the URL and a screenshot of the page that tried to persuade the visitor to enable notifications. This gives SmartScreen evidence earlier in the process, potentially before an abusive notification reaches anyone.

The distinction between delivery and deception is also visible in malicious Google Ads campaigns that lead visitors to fake security warnings. Different entry points can feed similar support scams, making the original source worth investigating alongside the warning itself.

Users retain a manual way to stop unwanted messages when automatic detection does not intervene. Microsoft advises opening the “…” menu on a website notification and disabling future notifications from that site.

Other buttons inside a fake alert may simply open more pop-up windows, so interacting with its supposed repair controls can prolong the scam.

For security teams, the practical value is a shorter repeat-exposure window. Blocking a detected destination helps with one encounter; withdrawing the sender’s notification access also interrupts future attempts from that source.

Microsoft describes the broader approach as connecting browser-side detection, user reports and cloud reputation to turn individual observations into protection for more users.

Indicators of compromise (IoCs):-

Indicator type	Source disclosure
Malicious domains, URLs and IP addresses	Not provided
SHA-256, SHA-1 and MD5 hashes	Not provided
Named malware family	Not identified

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.