Microsoft has deployed several measures to enhance the security of Windows 11 systems and introduced security features such as "Enhanced Security" for Edge browser . However, recently anti-virus solution provider Malwarebytes discovered a malicious activity that enabled technology-enabled scams by implanting malicious ads in the "My Feed" area in the Edge browser.
The image above is a screenshot of a malicious advertising campaign showing a fake browser locker page to deceive potential victims. The following diagram shows the steps that explain how the activity works. The adware works smartly because Malwarebytes found that malicious ad banners only redirect potential targets to Tech Support scam pages.
At the same time, the bot, VPN and geolocation are displayed in the actual ad page powered by the Taboolah ad network. The company notes that differentiation is implemented with the help of base64-encoded JavaScript strings.
In just 24 hours, Malwarebytes managed to collect more than 200 different host names. One of the related domains is associated with an individual who appears to be the director of a software company operating in Delhi, India. You can find more details about this malicious advertising campaign in the Malwarebytes blog post about the topic.
