I’m seeing Trojan:JS/Flafisi.D detections and Tech Support Scams on the Edge browser Start page

Here is an example of an offending domain i was redirected to from MSN (which attempted to malware me)... using edge...

Cmon Microsoft... do something.

hxxps://mai2olinkwissenschaft.org/2720392039203.... tons of numbers..

"So the payload is really irrelevant, and the point (once again) is that there’s an open malware channel on the MSN news pages."

You can sit around and pontificate about who's truly responsible to manage the security of the advertising distributed from websites until you're blue in the face.

Or if you have a modicum of intelligence, you'll realize that the only one truly responsible for your security is yourself, so by simply using an ad blocker or Internet Explorer's Tracking lists for reputable websites that honor it, you can avoid this issue entirely.

I prefer methods that work to wishful thinking.

Rob

"So the payload is really irrelevant, and the point (once again) is that there’s an open malware channel on the MSN news pages."

You can sit around and pontificate about who's truly responsible to manage the security of the advertising distributed from websites until you're blue in the face.

Or if you have a modicum of intelligence, you'll realize that the only one truly responsible for your security is yourself, so by simply using an ad blocker or Internet Explorer's Tracking lists for reputable websites that honor it, you can avoid this issue entirely.

I prefer methods that work to wishful thinking.

Rob

Did you miss my repeated recommendations for using uBlock Origin for blocking this malvertising campaign; and the fact that I’m currently testing it on designated “blocker-on” days? But if you’re suggesting that I should personally just leave uBlock Origin turned on and forget about this issue, then you’ve misunderstood things pretty badly. I set up this thread in order to monitor the status of this month-long malvertising issue on the MSN news portal. From the standpoint of monitoring things, turning on an ad-blocker just masks the underlying issue. As of yesterday today, MSN viewers are still being exposed to this malvertising campaign, presumably including users on older versions of Windows and/or with third-party AV apps who are reporting this issue by filename, but not reporting any associated AV detection.

Looking around the web, it’s pretty clear that no one else in the security sphere has ever suggested that hosting a malvertising campaign is a no-action-needed scenario for website owners and administrators, and I’m still hopeful that we won’t be setting a new precedent here. But in the long term, malvertising won’t be manageable without local website analytics of some kind, and I was merely suggesting that Microsoft could establish a more advanced in-house website analytics that leverages feedback from Windows Defender Advanced Threat Protection telemetry and analytics. But they could also work with a third-party website security analytics firm that's demonstrated the capability for rooting out these compromised domains (like Malwarebytes).

Since this thread is now only serving to divert attention from the issue at hand, I’ll only be monitoring the high-traffic thread. I'd rather spend my time on prototyping a noiseless directional UHF antenna for spectrum analyzers and RF imagers.

Gadzooks, it’s two-for-one Tuesday at both Wendy’s and the MSN news portal:

GreginMich

Thank you...I've been having both these issues for weeks now, and I was so puzzled because I've been using Windows Defender, and I never go to pages where I would expect something like this to happen...usually just MSN sites...I thought they were relatively "safe".  I'm old and not really tech savvy...your recommendation to use an Ad Blocker is what I'm going to try next, since I did every single thing that Windows Defender told me to, and it keeps happening.

Microsoft sites generally are safe, and Microsoft has responded to previous malvertising incidents in short order, at least from what I can gather. But this current malvertising incident is still posing a security risk for unsuspecting viewers; and eroding consumer confidence – and it will soon be taking a big bite out of the site’s advertizing revenues as viewers are forced to deploy ad-blockers in order to protect themselves. So this is a no-win situation for all parties concerned, and I can only hope that it does get resolved soon, and recommend using an ad-blocker extension in the interim.

Installing an ad-blocker extension in Edge is safe and easy, because the Settings menu will take you directly to the Microsoft Store, where you’ll find a good selection to choose from. I’m very impressed with the effectiveness of uBlock Origin in mitigating this issue, and also with the way it gives us such a clear window into the extensive domain connection activity that’s going on behind the scenes at all of the high-profile sites. But others have reported success with AdBlocker Ultimate, which is also very well-reviewed. And of course, these extensions are all free, so if you’re unhappy with the first one you pick, you can just switch over to another one:

For Microsoft Edge, find an ad-blocker extension in the Microsoft Store:

Settings and more > Extensions > Get Extensions from the Store

The documentation for uBlock Origin (and the instructions for installing it on other browsers) is available here:

https://github.com/gorhill/uBlock

GreginMich