0

I have a user who has reported that they are getting a Windows Security pop up from Outlook that keeps showing up even after clicking Cancel and signing out/in shown below

enter image description here

Luckily, the user didn't put in their credentials.

Below are some things I've checked from a security standpoint:

  1. Checked the URL in the image using an analysis tool. Nothing malicious came back.
  2. Checked the URL http://cdn.goalline.ca it redirects to https://stacksports.goalline.ca/. Nothing malicious there as well.
  3. Checked the domain cdn.goalline.ca and nothing malicious. Appears to be registered 20yrs ago and lines up with the stacksports site stating that it was founded in 2002.
  4. Checked enterprise AV, MS Defender, etc. and nothing malicious comes back.
  5. Checked list of applications and there were no recent installs or any programs that point to the URLs.

From a security perspective, it seems that there's nothing malicious. Is there anything else I'm potentially missing/need to check?

Also, how can I stop the pop up from re-occurring?

Improve this question
5
  • How do you know this dialog is presented by Windows, not by some malware? Do you know what process displays it? Have you analyzed the image of this process?
    – mentallurg
    Apr 4 at 21:59
  • 2
    My question: why would that link be prompting for an email : pwd ? (and over http, not https). And why through outlook? subscribe_ical suggests that maybe the user has some goalline junk in their calendar (even in the past) and now Outlook is stuck in some loop of trying to download the content, but hitting HTTP Basic Auth or something. Maybe deleting whatever it is out of their calendar will make the popups stop?
    – Mike Ounsworth
    Apr 4 at 22:40
  • This looks like someone added an authenticated calendar item to the user's calendar. Search the calendar for something related to the domain or keywords
    – schroeder ♦
    Apr 5 at 8:52
  • 1
    @schroeder Yup this was exactly it. Looked at his calendar and there was a subscribe_ical located there. Navigated to his account settings under the Internet Calendar tab and removed it there.
    – Nina G
    Apr 5 at 14:04
  • @NinaG Glad to help
    – schroeder ♦
    Apr 5 at 14:14

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.