I’m seeing Trojan:JS/Flafisi.D detections and Tech Support Scams on the Edge browser Start page

All of these are scams I have seen more than once.

As long as your Adobe Flash Player is turned off in Edge it isn't going to be updating come hell or high water. 

The other scams are usually of the "drive by" sort which means the website you are visiting just happened to have a "lurker at the threshold" when you visited...whether you are using the "Edge" homepage or a different one (personally I use the Microsoft Page as my "Home Page" and have never seen any of these THERE, at least).

But I do encounter them here and there...now and then. One day I'll meet one at a usually "safe" page "Daily Videos" for example or one of the various news sites. The answer, of course, as I know everyone here knows is not to respond and to shut your browser down using your "Task Manager".

I understand that some have a problem using this as the page "reloads" automatically when they open their browser again. This setting fixes that:

And, of course, this setting also helps a good deal with these nuisances:

Well, that's my contribution to the discussion, anyway.

I just walked away for about 20 minutes to check on a Windows 10 reinstallation that I’m doing for a friend – and this is what had replaced my news article upon my return:

So now I’m wondering if the issue might be more easily reproducible if you just give the page some time to cycle through all of its ads. I’ll give that a try myself on another machine.

GreginMich

OK, that's helpful, since from past experience with the MSN home page I know that all of these articles are sourced from someone else, with Microsoft nothing but a façade that provides access to these and other MSN front ends.

Yahoo, on the other hand, provides much of the news and other articles on their own sites.

What this implies to me is that the attacks are likely coming from another site, through the advertising or other portions of the display that might be embedded within the supposed MSN sub-pages you're viewing.  It's still possible they're simply embedded within the ads delivered directly to the MSN generated pages, but that should result in them displaying on the main start page as well.

It's also possible that the specific ads used to deliver these are tuned to the political affiliations or tendencies of those reading such articles.  As with phishing where the misspellings and other flaws are actually filters used by the spammers to weed out the more aware who'd be less likely to take the bait, displaying these popups only to those reading specific types of articles may provide a better response rate for the scammers.

Rob

There’s always the happy thought that they might have patched things up and made everything better by now. But I spend lots of time navigating on the Edge Start page (these attacks only occur after navigating to a specific article), and after a weeklong lull had me believing that everything was all better, I was hit again. So the highly intermittent and sporadic nature of these attacks makes them very hard to reproduce – and consequently the “observational data” will probably have to come mostly from the first-hand accounts of people who’ve been hit by one of these attacks. The upside is that this attack vector won’t be very effective if it’s limited to these occasional sniper shots.

GreginMich

I tried to duplicate this problem myself using Edge after disabling all my more restrictive settings and enabling the newsfeed and top sites for both the start page and new tabs.  Have yet to see a single popup with only Windows Defender in real-time operation (MBAM free version only).

I even tried browsing all over the various Yahoo News sites worldwide and clicking random, mostly politicl articles in both that and the MSN driven start page and still nothing.

Any thoughts?

Rob