I’m seeing Trojan:JS/Flafisi.D detections and Tech Support Scams on the Edge browser Start page

I'm just as frustrated at these issues as most of you are. My team has been working on trying to identify the culprit - we believe an ad is at play, but the ad creatives have been sneaky in hiding their tracks and we're sifting through terabytes of telemetry data that could potentially lead into finding the culprit. Once we do, we'll block it and go after the folks who designed it so we can prevent from happening. 

I apologize for the delay in getting this resolved. It has proven trickier than I expected. For those who do get this often, the idea thing would be have fiddler running at the same time and save the trace for my team to review, but it's a hard to ask of anyone so I'm pursuing the route of telemetry data analysis instead.

we understand your frustration as we are having to "control alt delete" to stop our pc's from screaming "YOUR PC IS INFECTED! Alert, Call this number, this site is stealing your info"...  I know its not infecting the PC but it locks up Edge.

You shouldn't be trying to hunt down these sites, the Edge team should be fixing this and it should be a #1 priority so it can't happen like with Chrome/Firefox...  You should be banging on the door of the Edge team going FIX THIS NOW.

This is why hundreds of thousands of people leave Edge and get firefox/Chrome everyday.

If MS doesn't care about Edge then seriously cancel it and bundle Windows with Chrome.

It doesn't even look like MS uses Edge... its sad really.

Rodrigo,

Is that the same telemetry data that the Windows Defender/Anti-Malware teams can provide, since I mentioned to Greg, the originator of this thread that he should suggest you contact them?

They're obviously able to identify at least the incidents which invoke the Trojan identified in this thread, so I'd think that this might aid in narrowing those particular events down, though that also depends upon whether they can be traced back to the page which originally invoked the redirect.

I would assume that these ads are not only being targeted at particular types of users, but also that the advertisers involved are using the same techniques that were identified by the Confiant security group in this article about the Ziconium group in January.  This allows them not only to filter for their targets, but also to avoid triggering the ads for security researchers and others trying to find them like your group.

Uncovering 2017’s Largest Malvertising Operation – Confiant

As a side note, I eventually realized that in my own case it's my relatively extreme privacy and other settings that allow me to avoid these completely.  Since I have the Advertising ID turned off and also normally use Internet Explorer with both tracking cookies blocked and IE Tracking protection enabled with the EasyPrivacy list, I'm an unlikely target for this type of attack.  My settings have less to do with malvertising than my own aversion to the noise that ads create, but apparently has the side effect of suppressing these type of targeted attacks as well.

Rob

It's not the same telemetry as Defender. What my team is looking at is to see the actual creative IDs that were served prior to the auto-redirect that happens. This comes from MSN owned telemetry, but digesting the historical browsed data in anonymous fashion is very expensive which is why I've been asking for some clues from users in the forms of new feedback entries.