Tuesday, July 16, 2024

Hackers Use Microsoft Edge’s News Feed to Redirect Websites Pushing Tech Support Scams

Microsoft Edge News Feed is currently being flooded with ads that appear to be sponsored by a widespread malvertising campaign that pushes tech support scams into potential victims’ news streams.

Currently, Windows OS computers come with the Microsoft Edge web browser installed as the default web browser. 

A global share of 4.3% is currently held by Microsoft Edge, making it one of the world’s most popular web browsers.

Malvertising on Microsoft Edge’s News Feed

At least two months have passed since this scam operation was launched, reported by the security analysts at Malwarebytes Threat Intelligence Team. 

While based on the amount of telemetry noise that it generates, this is by far one of the most extensive campaigns that are running right now.

Hundreds of subdomains under the ondigitalocean[.]app were switched between by the attackers during the course of a single day in order to host the scam pages. As the attack was of such a large scale, it is not surprising that this would happen.

Aside from injecting several malicious advertisements into the Edge News Feed timeline, they are also linking each of them to a bunch of domain names. It is also known that one of them (tissatweb.us) had previously hosted a browser locker and other malware.

When Edge users are sent a redirection flow, several of the settings in their web browsers are checked to decide if the redirection is worth the target’s time, such as timezone. 

That decision is completely based on the results of the previous check. If they don’t, then a decoy page will be sent to them in place of real web pages.

The threat actors use the Taboola ad network to redirect potential victims to their scam landing pages. The script that is used to filter the potential victims is Base64 encoded and is loaded by the Taboola ad network.

As far as Malwarebytes is concerned, it did not discuss what happens when you call the number associated with the scammers.

A variety of methods may be used to lock your computer in most of the cases that were reported. The threat actors might also try to entice you into buying a support license for your device, claiming it is infected with malware.

Domains Used

The following domains are associated with this malvertising campaign:-

  • feedsonbudget[.]com
  • financialtrending[.]com
  • foddylearn[.]com
  • glamorousfeeds[.]com
  • globalnews[.]cloud
  • hardwarecloseout[.]com
  • humaantouch[.]com
  • mainlytrendy[.]com
  • manbrandsonline[.]com
  • polussuo[.]com
  • newsagent[.]quest
  • newsforward[.]quest
  • puppyandcats[.]online
  • thespeedoflite[.]com
  • tissatweb[.]us
  • trendingonfeed[.]com
  • viralonspot[.]com
  • weeklylive[.]info
  • everyavenuetravel[.]site

All these above mentioned domain names were registered with the following email ID:-

  • sumitkalra1683@gmail[.]com

A person by the name of Sumit Kalra is the owner of this email address. While Sumit Kalra is documented as a director for a company that is located in Delhi:-

  • Mws Software Services Private Limited

In accordance with the company’s business disclosure, Computers, and related activities have been identified as its principal activity. The telemetry noise generated by this particular campaign is currently among the highest of any campaign currently running.


Latest articles

MirrorFace Attacking Organizations Exploiting Vulnerabilities In Internet-Facing Assets

MirrorFace threat actors have been targeting media, political organizations, and academic institutions since 2022,...

HardBit Ransomware Using Passphrase Protection To Evade Detection

In 2022, HardBit Ransomware emerged as version 4.0. Unlike typical ransomware groups, this ransomware...

New Poco RAT Weaponizing 7zip Files Using Google Drive

The hackers weaponize 7zip files to pass through security measures and deliver malware effectively.These...

New ShadowRoot Ransomware Attacking Business Via Weaponized PDF’s

X-Labs identified basic ransomware targeting Turkish businesses, delivered via PDF attachments in suspicious emails...

Hacktivist Groups Preparing for DDoS Attacks Targeting Paris Olympics

Cyble Research & Intelligence Labs (CRIL) researchers have identified a cyber threat targeting the...

Critical Cellopoint Secure Email Gateway Flaw Let Attackers Execute Arbitrary Code

A critical vulnerability has been discovered in the Cellopoint Secure Email Gateway, identified as...

Singapore Banks to Phase out OTPs for Bank Account Logins Within 3 Months

The Monetary Authority of Singapore (MAS) and The Association of Banks in Singapore (ABS)...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles