I’m seeing Trojan:JS/Flafisi.D detections and Tech Support Scams on the Edge browser Start page

Microsoft Edge doesn’t have an option to block Java scripts, and the original Group Policy setting for Edge that allowed users to block Java scripts has now been “disappeared”.  But I think that what I saw this morning was really just a glitch with turning on uBlock Origin. It’s pretty clear that uBlock is having some UI issues – probably resulting mostly from Edge’s efforts to replicate the display of the uBlock interface – so things are pretty buggy so far. But once we enable the advanced mode for this extension; and once we’re able to open the advanced user interface, this is very impressive:

With blocking turned off, the advanced user interface continues to monitor the connection of domains, and you can watch the list grow in real-time:

uBlock Origin documentation:

https://github.com/gorhill/uBlock/wiki

One of my main concerns here was that we might not have the ability to block scripts with this extension, but it looks like this thing has got all the bases pretty well covered – and I think we’ll be able to block virtually anything once we get er tuned up. So this is definitely going to be a “keeper” for me, one way or the other.

GreginMich

But Microsoft Edge blocks Java by default. So why am I still getting hit with this stupid thing?

Evil is going on here, that's what.

Now, here's the part that I find particularly frustrating. Edge is supposed to block pop-ups as a matter of course. That's what I ASSUMED this setting was for, anyway: 

Now, while I fully realize that won't block ads, as such, it should be blocking SOMETHING!!!

And Trojans would be a confoundedly good place to start!

I think this threat was being blocked in my case because I had Automatic Remediation disabled and Defender had to initially block the threat each time in order to provide the choice of actions that we have when Automatic Remediation is turned off:

https://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning-windows_10/jsflafisid-malwarebytes/fa09a912-196f-40ab-bfd7-99c74d663fe8#LastReply

Automatic Remediation is now turned on, and the Severe Threat Default Action is set to “Quarantine” – so we’ll see what happens now.

The issue has been reported to be Microsoft-browser specific, so we need to determine whether or not these redirects can be effectively controlled by users in a much more general way - and the critical test here is to see whether or not these attacks can actually be eliminated on the MSN news pages by using an ad-blocker. Yesterday was a blocker-off day ,and I was hit with another fake Adobe Flash Player update (Trojan:JS/Flafisi.D):

And also by this rather bizarre redirect:

Today will be a blocker-on day.

And I hope the day gets better as we go along, because I just went to the Start page, turned on uBlock Origen, clicked on a news article – and was greeted with this:

Good grief. What's going on here?

GreginMich

I'd be interested to know what is actually being detected and quarantined, as well as where it's being detected.

If it's being detected in the browser cache, it's highly possible that this is the result of the Edge browser's default setting to Use page prediction..., since this may cause the detected file to be downloaded before the user actually clicks on anything.

It's apparent that there's some sort of script or other vulnerability that's initially starting the process, but it's not clear if the next stage is still under user control or not.  We just seem to be assuming that the fact that Defender is activated means the file has made a successful intrusion.

Rob