Hunting Chromium Notifications

NVISO documents a social engineering scheme where fake CAPTCHA pages trick users into granting browser notification permissions, leading to persistent phishing notifications. The report explains how to locate and interpret Chromium artifacts for permissions and interactions, how to inspect Platform Notifications LevelDB, provides a Velociraptor artifact to hunt at scale, and recommends enforcing notification policies to mitigate this abuse.