3 ms·

Doing some analysis, this appears to be an injected bit of script attempting to automatically subscribe users to some sort of publisher of msn.com articles, as

Doing some analysis, this appears to be an injected bit of script attempting to automatically subscribe users to some sort of publisher of msn.com articles, as the tag type "social-lead-gen-in-article" is used for the publisher subscription box at the bottom of MSN articles, and it then attempts to find the "Subscribe Now" button and track clicks on it and add handlers to automatically perform whatever merchant actions. My takeaway at present is to avoid Edge and especially avoid Edge on MSN articles until such time as M$ drops some information on this.

segaloco 2y ago
For the record, if anyone is trying to investigate further, the only publisher I've found that has anything matching this going on (thus far) is Newsweek. Ex: https://www.msn.com/en-us/news/world/north-korea-reacts-to-nuclear-threat-from-us/ar-BB1mJEag?ocid=nl_article_link&cvid=fcd364abdfe14c9e830cf10699d1143c&ei=58 https://www.msn.com/en-us/news/world/north-korea-reacts-to-n... At the bottom of the article, the little Sign Up box is a "social-lead-gen-in-article" element. Still haven't seen anything else about this, it's a bit of a pain tbh, even if this has a very narrow attack surface, it's tying up multiple people in multiple places trying to make sense of it. C'mon Microsoft.
segaloco 2y ago
So did a bit more digging, searching for instances of "BuyNow" in various stuff loaded and I have some suspicion now this is being done by some service worker adjacent to MSN and Bing. I flushed the service workers related to these sites and then loaded one up again, I no longer get the console messages, but I do still get debugger:///VM* objects with a bunhc of BuyNow and message posting that looks like a more robust version of the script from the initial Github posting... Maybe Microsoft just silently dropped something out there. This is pointing more towards KomoD's suggestion this was something that escaped M$, but still makes me uneasy. Posting the code I found to the Github thread.
- dev_confused 2y ago
  Legend... thanks for looking into this, I am now less paranoid :)

segaloco 2y ago

For the record, if anyone is trying to investigate further, the only publisher I've found that has anything matching this going on (thus far) is Newsweek. Ex: https://www.msn.com/en-us/news/world/north-korea-reacts-to-nuclear-threat-from-us/ar-BB1mJEag?ocid=nl_article_link&cvid=fcd364abdfe14c9e830cf10699d1143c&ei=58 https://www.msn.com/en-us/news/world/north-korea-reacts-to-n... At the bottom of the article, the little Sign Up box is a "social-lead-gen-in-article" element. Still haven't seen anything else about this, it's a bit of a pain tbh, even if this has a very narrow attack surface, it's tying up multiple people in multiple places trying to make sense of it. C'mon Microsoft.

segaloco 2y ago

So did a bit more digging, searching for instances of "BuyNow" in various stuff loaded and I have some suspicion now this is being done by some service worker adjacent to MSN and Bing. I flushed the service workers related to these sites and then loaded one up again, I no longer get the console messages, but I do still get debugger:///VM* objects with a bunhc of BuyNow and message posting that looks like a more robust version of the script from the initial Github posting... Maybe Microsoft just silently dropped something out there. This is pointing more towards KomoD's suggestion this was something that escaped M$, but still makes me uneasy. Posting the code I found to the Github thread.

dev_confused 2y ago
Legend... thanks for looking into this, I am now less paranoid :)