From the blackhat link:
Technically, this pairing happens through a receiver application installed on the phone or tablet. The business model is that users will receive rewards or useful services for keeping those apps active,
The lesson here is that when an app asks permission to send you push notifications, always say “no.”
