I’m seeing Trojan:JS/Flafisi.D detections and Tech Support Scams on the Edge browser Start page

Hi all,

I'm on the MSN Engineering team and would love help if anyone encounter this again. We've been tracking this since it started in mid February. We do quite a bit of work to scan the ads we get from our exchanges, but some behave differently for certain users than they do when we do our scanning. In the future, please continue to submit feedback so we can narrow the scans on our end and potentially reproduce and remove this once and for all. If your page was hijacked and you couldn't view the article, please mention the article headline you've visited as well. 

If anyone is still experiencing this, please reply here. 

Thanks,

-Rodrigo (MSN Engineering)

Hey Greg,

I've seen reports of those coming from any page that includes advertising, including MSN which is the source of the default page for Edge as well as IE 11 as I recall.

I turned off these start pages in favor of a blank page immediately myself, not for this reason, but rather simply because I don't like the lag and noise these create when I open a browser.

I did have difficulty figuring out how to stop them with new tabs in IE 11 though, until I found out there was a separate control for this within the Internet Options - Tabs section on the General tab.

As Julia often mentions as well, I've found that ad blocking is the most effective method to stop these, since it's the advertising networks who distribute the initial scripts and typically don't vet their advertisers well if at all.  What a surprise huh?

Rob

I just got this issue just now 8 pm Central time 4/9/2018 on a Windows 10 machine viewing the article from the Edge MSN home page: "Tommy Lee's son won't be charged for allegedly assaulting him".  It showed me the fake Adobe Flash update warning and then Defender warned me that it Quarantined: Trojan:JS/Flafisi.D.

This is the 2nd time in a week this same virus hit me from an article from the Edge default page.

Hi all,

I'm on the MSN Engineering team and would love help if anyone encounter this again. We've been tracking this since it started in mid February. We do quite a bit of work to scan the ads we get from our exchanges, but some behave differently for certain users than they do when we do our scanning. In the future, please continue to submit feedback so we can narrow the scans on our end and potentially reproduce and remove this once and for all. If your page was hijacked and you couldn't view the article, please mention the article headline you've visited as well. 

If anyone is still experiencing this, please reply here. 

Thanks,

-Rodrigo (MSN Engineering)

Hi Rodrigo,

Your attention to this issue is greatly appreciated by myself as CM and I'm sure other frequent contributors  in Virus & Malware. We seldom get engagement from members of technical teams

To assist in generating more feedback I am requesting this thread be pinned and I have also edited to OP to reflect your request. I included a direct link to your reply as it is somewhat obfuscated being on Page 7

Thanks.

~bhringer

PS As an aside FWIW I noted you replied to another participant in this thread. Out of respect and as part o general accepted protocol your reply should have been to the OP..

Greg,

We were both looking on the wrong direction here, focusing on the current malvertising symptom while the deeper issue was occurring inside Microsoft itself.

After Thursday's announcement and it's obvious side effects, I did a quick search today regarding layoffs and found the second article below.

Windows boss Terry Myerson leaving Microsoft amid huge reorganization - Business Insider

Microsoft Layoffs in 2018 Impact Windows and Device Group

"Although the most severely impacted part of the business is the Windows and Devices Group, several other divisions faced job cuts as well. Employees were shed from product groups like “Bing”—the company’s oft-maligned search engine answer to “Google.”"

Since the MSN moniker is really just a legacy label that's likely now nothing more than a logo, I'd guess that most of the remaining portions of this advertising were driven by the Bing group mentioned in the previous excerpt.  If that group was already being reduced earlier this year before the announcement last Thursday, then I'd bet there's no plan to retain these legacy components for the long term, since as I mentioned these were nothing more than a reformatted set of 3rd-party news blogs anyway.

So I think that assuming Microsoft truly cares what happens to these pages is the mistake here, while it's the larger issues of where Windows itself is really headed and what form it takes in the future of Microsoft itself that's truly of concern at the moment.

"Terry Myerson, the executive vice president of Windows who has long been a leader at Microsoft, will leave the company "in the coming months" as part of a big reshuffling of executive leadership announced on Thursday. "

So if I'd taken the time to research deeper at the beginning, I'd have realized this entire discussion was pointless from the start, except as a warning that Windows users should assume that ad blocking is now the only effective method to protect yourself from malvertising on the legacy Windows platform.

Rob