How to detect when a notification pops up?

The notification that is used by JJSploit is built into the CoreGui service, therefore it cannot be detected with any Studio-made scripts as indexing any of these services will throw The current identity (2) cannot Class security check (lacking permission #). If you're curious -- nowadays, most exploits run at Roblox level, meaning that scripts and GUIs are hidden in private services and there's little to no chance of detecting them unless an error occurs on the exploiter's end.

In conclusion: you don't detect if a notification pops up. Even if you found a way to sniff out oddly created instances and wrote a script to delete them, it would be patched within days if not hours. Keep in mind that a player has full control over their client and the way it behaves, and therefore they can immediately delete, let's say, a LocalScript that's supposed to check for unusual client activity; there's no real way of stopping an exploiter other than having Server-sided checks.