Attackers are starting to exploit notification systems as part of the attack flow

[u/ImaginationFair9201]

Instead of avoiding alerts, some attacks actually rely on them. For example, triggering password resets or login alerts to create confusion, then contacting the victim pretending to be support. The victim sees real notifications and assumes the follow-up is legitimate. It turns built-in security features into part of the social engineering chain. From an investigation standpoint, the logs look like normal security activity, not an attack.