Forum Discussion

Dhuinda's avatar
Dhuinda
Copper Contributor
May 03, 2022

TokenFactory IFrame Issue

As of recent, my organizational outlook email, as well as other people who are associated with different organizations are having an issue on the Safari browser such that Outlook keeps attempting to download a TokenFactory IFrame component. This file has no data, and I have only found that I can reproduce the issue on Safari. This seems to be an issue with two-factor authentication, but I'm not entirely sure. 

17 Replies

    • Luchotamblay's avatar
      Luchotamblay
      Copper Contributor
      https://howtoremove.guide/token-factory-iframe-mac/

      What is Token Factory Iframe?
      Token Factory Iframe is a page-redirecting app that will immediately begin to reroute your web traffic the moment it gets installed in your browser. Token Factory Iframe has been categorized as a browser hijacker that aims to aggressively promote sponsored sites on the user’s screen.

      The main activity of these apps is related to online advertising and, for as long as they operate on your computer, most Browser Hijackers will only spam you with different sponsored ads, pay-per-click messages, pop-ups, banners, and redirects to predefined web pages. A real virus, on the other hand, is a threat that would do much more than simply spam your screen with commercials. For instance, a Ransomware infection can not only sneak in the system without any visible symptoms, but it can render your files inaccessible until you pay a ransom for them. A program like Token Factory Iframe is far less problematic and will never do such a thing, even if it tends to be extremely annoying and unpleasant to have in your browsing program.


      • GĂĽnter Born's avatar
        GĂĽnter Born
        Copper Contributor

        Two remarks about the posts above - just a kind of care: The suggestion from Luchotamblay to block downloads is surely a workaround - but as I wrote within my article, you are no longer able to download mail attachments. If you are affected, use Firefox as a temporary workaround - as I suggested within my original article.

        The second suggestion from Luchotamblay with the link to howtoremove guide should be taken with care (I would not post this external link in MS forums without a warning). After the initial incident reported above - and after I wrote my initial article - several sites also created an article "what is Token Factory Iframe" - and explain it as a browser hijacker. While that's probably not false, all sites offers a "free" removal tool.

         

        I just read the terms of use of their "free removal tool" - they try to trick incautious users to a subscription of 48 € (or $) for 6 months. Imho suspicious ...

        I have not seen (till yet) any report about an infection of a browser hijacker in the current case (although users has checked their macOS systems and browsers with tools like Bitdefender).

  • Yes for 2 days now. Thought it was malware. Hope it isn't. Very annoying and distracting. What does it even mean?
  • Luchotamblay's avatar
    Luchotamblay
    Copper Contributor

    I have been able to replicate this issue and found that you can stop the Safari Downloads by going to Safari/Preference/Websites/Downloads and select "DENY" for Configured Websites - Outlook and or Office.com. This will stop the "TokenFactoryiFrame" from auto downloading evey 10 secs or so. Now this is just a temp fix until "Micorsoft" finds the issue and offers a resolution. Good Luck and hope this info helps!

    • BarbG11's avatar
      BarbG11
      Copper Contributor
      Thank you - that worked for now.
  • GĂĽnter Born's avatar
    GĂĽnter Born
    Copper Contributor

    It seems to me as an attempt to get an OAuth token to access Outlook via (OWA) can't be detected and results in a useless download.

    I've documented it within this blog post:

    Apple's Safari has an Outlook TokenFactoryIFrame issue (May 2022)

    and asked MS answers forum moderators to forward the issue to the responsible Microsoft product group. Microsoft has to fix that issue.

     

    Addendum (2022/05/05): The issue has been fixed - see the post from Microsoft Answers Forum:

    Shyamal Debnath – MSFT
    Microsoft Agent | Moderator
    Replied on May 5, 2022
    Hi All,
    This issue was posted to the Service Health Dashboard (SHD) as incident EX375556, Start time: Monday, May 2, 2022, at 8:57 PM UTC.
    User Impact: Users are repeatedly prompted to download "TokenFactoryIframe" when browsing Outlook on the web via Safari on Mac OS.
    More info: Users report seeing the same download prompt when accessing office.com as well from the Safari browser.
    Current status: The deployment of the fix has completed in the majority of the environments, and we've confirmed with some reporting users that the impact is remediated. We're continuing to monitor the progression of the fix as it finishes deploying to ensure the issue is resolved for all remaining environments.
    Tenant administrators can view current information and updates on SHD at the link here https://portal.office.com/AdminPortal/Home#/servicehealth
    For affected customers to easily identify the information here, this thread will be closed. We will update to the thread once the issue is resolved or you can obtain the most recent information from SHD.
    Your patience and cooperation are highly appreciated.
    Best regards,
    Shyamal

      • GĂĽnter Born's avatar
        GĂĽnter Born
        Copper Contributor
        See the mentions within the article - the best is to use Firefox to access your OWA account.
  • izzyalicia210's avatar
    izzyalicia210
    Copper Contributor

    Dhuinda I'm having the same issue. It beens going on since two days now. I'm not sure whats going on. But I hope it's nothing to concerning.

Resources