why would it be i stated i tested it in a safe environment that usually means either a blank slate computer or a simulated blank slate computer.
the former to be clear in my case.
Fair enough, thanks for clarifying the testing environment. Just in case, I'm not doubting what you saw, just trying to pinpoint the source.
Since the destination was a "Web App" style site, what likely triggered on your clean slate was a PWA (Progressive Web App) installation prompt or a forced browser notification request. On a fresh browser, those scripts often look and act exactly like a file download initiation or a security intrusion (especially on Google Chrome or just Chromium based browsers for some reason).
Whether it was a literal payload or just aggressive browser-hijacking scripts, the result is the same: it’s garbage that degrades the user experience and looks unsafe, which is exactly why the ad campaign got pulled, so just so we're on the same page here, garbage like that 100% doesn't belong here.
