How to remove malicious notifications?

[wasphin]

Select Topic Area

Bug

Body

Cann't remove malicious notifications from filter.

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐

[vishwaswami24]

This is a very common and annoying problem. Those "malicious notifications" are almost always browser notifications that you were tricked into allowing from a deceptive website.

A site might have shown you a pop-up that looked like a "click to play video," "prove you're not a robot," or "accept" button, but it was actually a hidden "Allow Notifications" prompt.

Here is how to find and remove them on any device.

🚨 How to Remove Malicious Notifications (By Device)
Find your browser or device in the list below and follow the steps.

1. On a Computer (Windows, Mac, or Linux)
   The fix is inside your browser settings.

🌎 Google Chrome
Click the three-dot menu (⋮) in the top-right corner.

Go to Settings.

Click Privacy and security on the left.

Select Site Settings.

Scroll down and click Notifications.

Look in the "Allowed to send notifications" section.

Find the suspicious website URL (the one you don't recognize or trust).

Click the three-dot menu (⋮) next to it and select Block or Remove.

🦊 Mozilla Firefox
Click the three-line menu (≡) in the top-right corner.

Go to Settings.

Click Privacy & Security on the left.

Scroll down to the Permissions section.

Click the Settings... button next to Notifications.

A window will pop up with a list of all sites. Find the malicious site.

Click on it, then click Remove Website.

💻 Microsoft Edge
Click the three-dot menu (⋯) in the top-right corner.

Go to Settings.

Click Cookies and site permissions on the left.

Find and click Notifications.

Look in the "Allow" section.

Find the suspicious website, click the three-dot menu (⋯) next to it, and select Block or Remove.

🧭 Safari (on Mac)
With Safari open, click Safari in the top-left corner of your screen (by the Apple menu).

Go to Settings... (or Preferences... on older macOS versions).

Click the Websites tab.

Click Notifications on the left-hand sidebar.

You will see a list of websites. Find the one you don't trust.

Click on it and press the Remove button at the bottom.

2. On a Mobile Phone or Tablet
   📱 iPhone or iPad (Safari)
   This is a special case. Malicious notifications on an iPhone only happen if you were tricked into adding a "Web App" to your Home Screen.

Go to your iPhone's Settings app.

Tap Notifications.

You will see a list of all your installed apps. Look carefully for the name of a "web app" you don't recognize. It will have a website's icon and name (e.g., "Free-Downloads.com").

Tap on that suspicious app.

Turn the "Allow Notifications" toggle OFF.

To permanently remove it: Go to your Home Screen, find the icon for that web app, tap and hold it, then select Delete App.

🤖 Android Phone (Chrome)
Open the Chrome app.

Tap the three-dot menu (⋮) in the top-right corner.

Tap Settings.

Scroll down and tap Site settings.

Tap Notifications.

You will see a list of sites. Find the suspicious website in the "Allowed" section.

Tap on the website's name.

Tap Clear & reset. (Or, on some versions, you can just tap "Notifications" and toggle it off).

How to Prevent This from Ever Happening Again
The best defense is to be critical of permission prompts.

Just Say No: When a website you don't explicitly trust (like your email or a major news site) asks "Show notifications?" always click "Block."

Read the Prompt: Scammers hide the real prompt. You might click "Play" on a video, and your browser then asks, "Do you want to allow [https://www.google.com/search?q=scam-site.com] to send notifications?" Read that browser-level prompt before clicking.

Disable Prompts Entirely: If you never want to be asked again, you can turn off the feature.

In Chrome's Notification settings (from the steps above), select the option for "Don't allow sites to send notifications."

In Firefox, you can check the box for "Pause notifications until Firefox restarts."

[wasphin]

Thanks, but this is not the case of notifications of browser.

[DmitrySadovnikov]

Hi @wasphin,

You can use the GitHub CLI to mark the notifications as read:

gh api notifications\?all=true | jq -r 'map(select(.unread) | .id)[]' | xargs -L1 sh -c 'gh api -X PATCH notifications/threads/$0'

To remove them from the sidebar, I used:

gh api notifications\?all=true | jq -r '.[] | select(.subject.title | test("(paradigm|Lido|gitcoin)"; "i")) | .id' \
| xargs -L1 -I{} gh api \
  --method DELETE \
  -H "Accept: application/vnd.github+json" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  /notifications/threads/{}

If you don’t have the CLI installed, you can add it via Homebrew:

brew install gh

Github CLI Doc
Github API Doc

[wasphin]

Thanks you so much, those notifications were driving me crazy.

Removed as below:

gh api notifications\?participating=true | jq '.[].id' | xargs -L1 -I{} gh api \
  --method DELETE \
  -H "Accept: application/vnd.github+json" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  /notifications/threads/{}