Wednesday, April 24, 2024

Hackers Use Microsoft Edge’s News Feed to Redirect Websites Pushing Tech Support Scams

Microsoft Edge News Feed is currently being flooded with ads that appear to be sponsored by a widespread malvertising campaign that pushes tech support scams into potential victims’ news streams.

Currently, Windows OS computers come with the Microsoft Edge web browser installed as the default web browser. 

A global share of 4.3% is currently held by Microsoft Edge, making it one of the world’s most popular web browsers.

Malvertising on Microsoft Edge’s News Feed

At least two months have passed since this scam operation was launched, reported by the security analysts at Malwarebytes Threat Intelligence Team. 

While based on the amount of telemetry noise that it generates, this is by far one of the most extensive campaigns that are running right now.

Hundreds of subdomains under the ondigitalocean[.]app were switched between by the attackers during the course of a single day in order to host the scam pages. As the attack was of such a large scale, it is not surprising that this would happen.

Aside from injecting several malicious advertisements into the Edge News Feed timeline, they are also linking each of them to a bunch of domain names. It is also known that one of them ( had previously hosted a browser locker and other malware.

When Edge users are sent a redirection flow, several of the settings in their web browsers are checked to decide if the redirection is worth the target’s time, such as timezone. 

That decision is completely based on the results of the previous check. If they don’t, then a decoy page will be sent to them in place of real web pages.

The threat actors use the Taboola ad network to redirect potential victims to their scam landing pages. The script that is used to filter the potential victims is Base64 encoded and is loaded by the Taboola ad network.

As far as Malwarebytes is concerned, it did not discuss what happens when you call the number associated with the scammers.

A variety of methods may be used to lock your computer in most of the cases that were reported. The threat actors might also try to entice you into buying a support license for your device, claiming it is infected with malware.

Domains Used

The following domains are associated with this malvertising campaign:-

  • feedsonbudget[.]com
  • financialtrending[.]com
  • foddylearn[.]com
  • glamorousfeeds[.]com
  • globalnews[.]cloud
  • hardwarecloseout[.]com
  • humaantouch[.]com
  • mainlytrendy[.]com
  • manbrandsonline[.]com
  • polussuo[.]com
  • newsagent[.]quest
  • newsforward[.]quest
  • puppyandcats[.]online
  • thespeedoflite[.]com
  • tissatweb[.]us
  • trendingonfeed[.]com
  • viralonspot[.]com
  • weeklylive[.]info
  • everyavenuetravel[.]site

All these above mentioned domain names were registered with the following email ID:-

  • sumitkalra1683@gmail[.]com

A person by the name of Sumit Kalra is the owner of this email address. While Sumit Kalra is documented as a director for a company that is located in Delhi:-

  • Mws Software Services Private Limited

In accordance with the company’s business disclosure, Computers, and related activities have been identified as its principal activity. The telemetry noise generated by this particular campaign is currently among the highest of any campaign currently running.

Download Free SWG – Secure Web Filtering – E-book


Latest articles

Researchers Uncover that UK.GOV Websites Sending Data to Chinese Ad Vendor Analysts

Analysts from Silent Push, a data analytics firm, have uncovered several UK government websites...

Ransomware Victims Who Opt To Pay Ransom Hits Record Low

Law enforcement operations disrupted BlackCat and LockBit RaaS operations, including sanctions on LockBit members...

IBM Nearing Talks to Acquire Cloud-software Provider HashiCorp

IBM is reportedly close to finalizing negotiations to acquire HashiCorp, a prominent cloud infrastructure...

Rewards Up to $10 Million for Information on Iranian Hackers

The United States Justice Department has announced big rewards for information leading to the...

PoC Exploit Released For Critical Oracle VirtualBox Vulnerability

Oracle Virtualbox was identified and reported as having a critical vulnerability associated with Privilege...

Tracing the Steps of Cyber Intruders: The Path of Lateral Movement

When cyber attacks strike, it's rarely a single computer that suffers. Nowadays, cybercriminals set...

U.S. to Impose Visa Restrictions on 13 Individuals Involved in Commercial Spyware Operations

To combat the misuse of commercial spyware, the United States Department of State has...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.


Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles