Wednesday, December 6, 2023

Hackers Use Microsoft Edge’s News Feed to Redirect Websites Pushing Tech Support Scams

Microsoft Edge News Feed is currently being flooded with ads that appear to be sponsored by a widespread malvertising campaign that pushes tech support scams into potential victims’ news streams.

Currently, Windows OS computers come with the Microsoft Edge web browser installed as the default web browser. 

A global share of 4.3% is currently held by Microsoft Edge, making it one of the world’s most popular web browsers.

Malvertising on Microsoft Edge’s News Feed

At least two months have passed since this scam operation was launched, reported by the security analysts at Malwarebytes Threat Intelligence Team. 

While based on the amount of telemetry noise that it generates, this is by far one of the most extensive campaigns that are running right now.

Hundreds of subdomains under the ondigitalocean[.]app were switched between by the attackers during the course of a single day in order to host the scam pages. As the attack was of such a large scale, it is not surprising that this would happen.

Aside from injecting several malicious advertisements into the Edge News Feed timeline, they are also linking each of them to a bunch of domain names. It is also known that one of them ( had previously hosted a browser locker and other malware.

When Edge users are sent a redirection flow, several of the settings in their web browsers are checked to decide if the redirection is worth the target’s time, such as timezone. 

That decision is completely based on the results of the previous check. If they don’t, then a decoy page will be sent to them in place of real web pages.

The threat actors use the Taboola ad network to redirect potential victims to their scam landing pages. The script that is used to filter the potential victims is Base64 encoded and is loaded by the Taboola ad network.

As far as Malwarebytes is concerned, it did not discuss what happens when you call the number associated with the scammers.

A variety of methods may be used to lock your computer in most of the cases that were reported. The threat actors might also try to entice you into buying a support license for your device, claiming it is infected with malware.

Domains Used

The following domains are associated with this malvertising campaign:-

  • feedsonbudget[.]com
  • financialtrending[.]com
  • foddylearn[.]com
  • glamorousfeeds[.]com
  • globalnews[.]cloud
  • hardwarecloseout[.]com
  • humaantouch[.]com
  • mainlytrendy[.]com
  • manbrandsonline[.]com
  • polussuo[.]com
  • newsagent[.]quest
  • newsforward[.]quest
  • puppyandcats[.]online
  • thespeedoflite[.]com
  • tissatweb[.]us
  • trendingonfeed[.]com
  • viralonspot[.]com
  • weeklylive[.]info
  • everyavenuetravel[.]site

All these above mentioned domain names were registered with the following email ID:-

  • sumitkalra1683@gmail[.]com

A person by the name of Sumit Kalra is the owner of this email address. While Sumit Kalra is documented as a director for a company that is located in Delhi:-

  • Mws Software Services Private Limited

In accordance with the company’s business disclosure, Computers, and related activities have been identified as its principal activity. The telemetry noise generated by this particular campaign is currently among the highest of any campaign currently running.

Download Free SWG – Secure Web Filtering – E-book


Latest articles

Hackers Use Weaponized Documents to Attack U.S. Aerospace Industry

An American aerospace company has been the target of a commercial cyberespionage campaign dubbed...

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles