Hackers Use Microsoft Edge’s News Feed to Redirect Websites Pushing Tech Support Scams

Microsoft Edge News Feed is currently being flooded with ads that appear to be sponsored by a widespread malvertising campaign that pushes tech support scams into potential victims’ news streams.

Currently, Windows OS computers come with the Microsoft Edge web browser installed as the default web browser. 

A global share of 4.3% is currently held by Microsoft Edge, making it one of the world’s most popular web browsers.

Malvertising on Microsoft Edge’s News Feed

At least two months have passed since this scam operation was launched, reported by the security analysts at Malwarebytes Threat Intelligence Team. 

While based on the amount of telemetry noise that it generates, this is by far one of the most extensive campaigns that are running right now.

Hundreds of subdomains under the ondigitalocean[.]app were switched between by the attackers during the course of a single day in order to host the scam pages. As the attack was of such a large scale, it is not surprising that this would happen.

Aside from injecting several malicious advertisements into the Edge News Feed timeline, they are also linking each of them to a bunch of domain names. It is also known that one of them (tissatweb.us) had previously hosted a browser locker and other malware.

When Edge users are sent a redirection flow, several of the settings in their web browsers are checked to decide if the redirection is worth the target’s time, such as timezone. 

That decision is completely based on the results of the previous check. If they don’t, then a decoy page will be sent to them in place of real web pages.

The threat actors use the Taboola ad network to redirect potential victims to their scam landing pages. The script that is used to filter the potential victims is Base64 encoded and is loaded by the Taboola ad network.

As far as Malwarebytes is concerned, it did not discuss what happens when you call the number associated with the scammers.

A variety of methods may be used to lock your computer in most of the cases that were reported. The threat actors might also try to entice you into buying a support license for your device, claiming it is infected with malware.

Domains Used

The following domains are associated with this malvertising campaign:-

• feedsonbudget[.]com
• financialtrending[.]com
• foddylearn[.]com
• glamorousfeeds[.]com
• globalnews[.]cloud
• hardwarecloseout[.]com
• humaantouch[.]com
• mainlytrendy[.]com
• manbrandsonline[.]com
• polussuo[.]com
• newsagent[.]quest
• newsforward[.]quest
• puppyandcats[.]online
• thespeedoflite[.]com
• tissatweb[.]us
• trendingonfeed[.]com
• viralonspot[.]com
• weeklylive[.]info
• everyavenuetravel[.]site

All these above mentioned domain names were registered with the following email ID:-

• sumitkalra1683@gmail[.]com

A person by the name of Sumit Kalra is the owner of this email address. While Sumit Kalra is documented as a director for a company that is located in Delhi:-

• Mws Software Services Private Limited

In accordance with the company’s business disclosure, Computers, and related activities have been identified as its principal activity. The telemetry noise generated by this particular campaign is currently among the highest of any campaign currently running.