French users of Microsoft games and services are being shown ads that redirect them to scam surveys, polls, or other unwanted promotions. Some of these ads are also able to escape Microsoft games to load the scam ads in the default browser used by Windows.
This ad campaign started April 23rd when users in France started to see their browsers redirected to advertisements at a site called getheprzietoday.club [1,2,3]. These ads were appearing in Microsoft services such as Hotmail and Outlook where users would suddenly find their browser redirected to ads showing surveys, polls, and spin-the-wheel scams.
According to research by French security researcher Malekal, who spoke to BleepingComputer about these scams, these surveys state that will give you an iPhone or Samsung phone if you fill out the survey. In reality, they simply harvest your personal information, which can be used in a variety of ways such as identity theft, spam, or for lead generation.
Malekal told BleepingComputer that one of the scams has you signup at a fake online store, where they will siphon off money from your accounts every month.
Ads escape Microsoft Games
Some Microsoft games, such as Microsoft Jigsaw, embed advertisements that are also affected by this campaign.
There are reports [1,2] of people playing Microsoft Jigsaw when an an embedded ad refreshes and then their default browser suddenly opens to a survey being displayed from the getheprzietoday.club site.
When BleepingComputer tried to generate some of these ads through a French VPN, we were not able to get any to show. In conversations with Malekal, we were told that the ads are filtering out VPNs and are focusing on residential IP addresses of users in France.
It is important to note that if you are being redirected to these types of scams from Microsoft services or games, you are not infected. Instead you are being shown ads that are causing these redirects.
BleepingComputer has reached out to Microsoft about this ad campaign and will update the story when we receive a response.