Fake virus warning sent via Safari Notifications
This happened to a client of mine. (I'll have to look up her OS X version).
What I discovered, is the bad guys manipulated Safari's Notification to make it look like a virus alert was coming from Mac OS.
Under Safari -> Settings -> Websites -> Notifications there was an entry that had no website name, but had an entry. (Sorry, I didn't think of taking a picture of this.)
Removing this entry caused the problem to go away.
Here's the alerts she got: