Skip to main content

Beware: Hackers are using a clever Microsoft Edge malvertising scam

If you’re still using Microsoft Edge, you need to beware — a new malvertising campaign has just been discovered, and if you fall victim to it, your PC might be at risk.

According to Malwarebytes, the attackers are abusing Microsoft Edge’s News Feed feature to target their victims. Here’s what we know about this clever new scam.

Screenshot of a Microsoft Edge scam attack.
Malwarebytes

Malvertising refers to incorporating malware into advertisements, which is exactly what’s happening in this latest Microsoft Edge scam. First spotted by Malwarebytes’ Threat Intelligence Team, the operation seems to have started at least two months ago, if not more. It’s hard to estimate how many people have fallen for the trick so far.

The scam campaign runs on a really large scale. The attackers supposedly switch between hundreds of different ondigitalocean.app subdomains per day and each one of those subdomains are used to host a scam website intended to scam unsuspecting Edge users.

The threat actors inject attention-grabbing ads into the Microsoft Edge news feed. If a user is tempted to check out the article, their browser is then checked for a number of things, such as their location and their timezone.

It seems that not all users are deemed to be “worthwhile” enough to proceed with the scam. If the user’s browser does not match the attacker’s requirements, they’re redirected to a decoy page and nothing else happens. However, if the user ticks all the boxes, they are directed to a scam landing page.

Assuming that the user makes it to the scam landing page, what follows is a well-known pattern that has been used by many threat actors in the past. The landing page tells the user that the Windows Defender Security Center found a trojan virus and blocked the computer for security reasons. They are then given a (supposedly toll-free) phone number to dial in order to unlock their computer.

Malwarebytes didn’t specify what happens if one calls the listed phone number, but the way this scam usually goes is that the scammers obtain remote control of your computer and lock it down until they are paid. This often appears to be legitimate and is less of extortion and more of a “pay us for fixing this technical issue for you” kind of thing. Users may also be offered to sign up for a longer-lasting tech support contract.

The Microsoft Edge browser is open on a Surface Book 2 in tablet mode.
Image used with permission by copyright holder

Microsoft Edge is the default browser for Windows users, and much like its (now retired) older sibling Internet Explorer, it’s mostly used to download a different browser. Statcounter puts Edge’s market share at 4.3%, making it a small fish in a big pond largely dominated by the shark that is Google Chrome (65.52%). It sometimes trades blows with Mozilla Firefox, which currently sits at a 3.16% market share.

For the time being, if you’re using Microsoft Edge and want to avoid problems, it’s best to ignore the news feed altogether and simply visit a reputable news site directly to stay up to date.

Editors' Recommendations

Monica J. White
Monica is a UK-based freelance writer and self-proclaimed geek. A firm believer in the "PC building is just like expensive…
DuckDuckGo’s Windows browser is here to protect your privacy
The Duck Player feature of DuckDuckGo's Windows web browser, showing a video being played.

A few months ago, DuckDuckGo launched a privacy-focused browser on macOS. Well, Windows users no longer have to miss out, as the browser has found its way onto Microsoft’s operating system. If you want a web browsing experience that protects your privacy, it could be a good time to check it out.

The browser is available as a public beta, according to a blog post from DuckDuckGo. It comes with a bunch of built-in privacy protections that could be ideal if you’re tired of trackers and cookies snooping on your internet sessions.

Read more
Chinese hackers targeting critical U.S. infrastructure, Microsoft warns
chinese hackers caught targeting vital us infrastructure china flags

State-sponsored hackers based in China have been working to compromise critical infrastructure in the U.S., Microsoft said on Wednesday. It’s thought the attacks could lead to the disruption of important communications between the U.S. and its interests in Asia during future crises.

Notable target sites include Guam, a small island in the Pacific with an important U.S. army base that could play an important role in any clash with China over Taiwan.

Read more
These 2 new Edge features are making Chrome look outdated
Copilot in Windows being used in the side panel.

Microsoft has announced a host of updates that will soon be available for its Edge browser, including the Microsoft 365 Copilot feature and Sidebar app support for developers.

The company is showcasing the new features during its annual Build developer conference, which is currently taking place from May 23 through May 25.

Read more