I’m seeing Trojan:JS/Flafisi.D detections and Tech Support Scams on the Edge browser Start page

I didn’t have any problem removing the Tech Support Scam, Cyber; and I already know how to report bad websites. If you review my profile, you’ll see that I did all of the original groundwork on identifying the dialog loop as the underlying issue with these Tech Support Scams, and also the promotional work for the Microsoft Dialog Loop Protection patch for this issue.

So that’s not really what this discussion is about – it’s really about the sudden appearance of malware and Tech Support Scams on the Edge Start page. I understand that my original title was impromptu and didn’t properly convey the content of the thread, so I agree that it should be changed. But I’m going to edit your edit in order to more accurately reflect the content of the discussion. 

Thanks,

GreginMich

I tried to duplicate this problem myself using Edge after disabling all my more restrictive settings and enabling the newsfeed and top sites for both the start page and new tabs.  Have yet to see a single popup with only Windows Defender in real-time operation (MBAM free version only).

I even tried browsing all over the various Yahoo News sites worldwide and clicking random, mostly politicl articles in both that and the MSN driven start page and still nothing.

Any thoughts?

Rob

There’s always the happy thought that they might have patched things up and made everything better by now. But I spend lots of time navigating on the Edge Start page (these attacks only occur after navigating to a specific article), and after a weeklong lull had me believing that everything was all better, I was hit again. So the highly intermittent and sporadic nature of these attacks makes them very hard to reproduce – and consequently the “observational data” will probably have to come mostly from the first-hand accounts of people who’ve been hit by one of these attacks. The upside is that this attack vector won’t be very effective if it’s limited to these occasional sniper shots.

GreginMich

OK, that's helpful, since from past experience with the MSN home page I know that all of these articles are sourced from someone else, with Microsoft nothing but a façade that provides access to these and other MSN front ends.

Yahoo, on the other hand, provides much of the news and other articles on their own sites.

What this implies to me is that the attacks are likely coming from another site, through the advertising or other portions of the display that might be embedded within the supposed MSN sub-pages you're viewing.  It's still possible they're simply embedded within the ads delivered directly to the MSN generated pages, but that should result in them displaying on the main start page as well.

It's also possible that the specific ads used to deliver these are tuned to the political affiliations or tendencies of those reading such articles.  As with phishing where the misspellings and other flaws are actually filters used by the spammers to weed out the more aware who'd be less likely to take the bait, displaying these popups only to those reading specific types of articles may provide a better response rate for the scammers.

Rob

I just walked away for about 20 minutes to check on a Windows 10 reinstallation that I’m doing for a friend – and this is what had replaced my news article upon my return:

So now I’m wondering if the issue might be more easily reproducible if you just give the page some time to cycle through all of its ads. I’ll give that a try myself on another machine.

GreginMich