Notification spam – malware?

[MentalFabric]

A less techie family member keeps getting these notifications so I removed them in System Preferences but they've re-appeared.

I think I also removed a browser extension first time around. I don't see any strange startup items or processes eating CPU. The Mac is running Sophos Antivirus which hasn't found anything. Is this a known form of malware or is it more likely they clicked allow notifications again and this is not actually malware? I'm considering erasing the Mac.

 

[Handoff]

Might be browser related, remove all notification subscriptions from the installed browser(s)

 

[MentalFabric]

Might be browser related, remove all notification subscriptions from the installed browser(s)

Thank you! Since I never allow notifications from websites I was oblivious to the fact Safari has separate settings for them to the System prefs. I've removed them from Safari and am keeping my fingers crossed…

It's peculiar to me that the notifications keep showing up even after permissions have been removed from System Preferences though. Why are there two places for the permission setting that aren't synced up?

 

[Fishrrman]

Does that "less-techy" person use bitcoin?

You could try MalwareBytes on his/her Mac.

 

[Handoff]

Thank you! Since I never allow notifications from websites I was oblivious to the fact Safari has separate settings for them to the System prefs. I've removed them from Safari and am keeping my fingers crossed…

It's peculiar to me that the notifications keep showing up even after permissions have been removed from System Preferences though. Why are there two places for the permission setting that aren't synced up?

Did it work?

I believe the notifications keep showing up because they're triggered by the browser which does have permission

 

[MentalFabric]

They don't use Bitcoin - I guess that app I made confuses matters! But it does appear to have worked, although I only handed the MBP back today. Can Safari add notification permissions back to system preferences without confirmation? Because they re-appeared there.