TokenFactory IFrame Issue

[Dhuinda]

As of recent, my organizational outlook email, as well as other people who are associated with different organizations are having an issue on the Safari browser such that Outlook keeps attempting to download a TokenFactory IFrame component. This file has no data, and I have only found that I can reproduce the issue on Safari. This seems to be an issue with two-factor authentication, but I'm not entirely sure. 

[#2]

@Dhuinda I'm having the same issue. It beens going on since two days now. I'm not sure whats going on. But I hope it's nothing to concerning.

[#3]

Same issue 🙄

[#4]

@Dhuinda I have exactly the same issue. It's a bit disconcerting TBH. 

[#5]

It seems to me as an attempt to get an OAuth token to access Outlook via (OWA) can't be detected and results in a useless download.

I've documented it within this blog post:

Apple's Safari has an Outlook TokenFactoryIFrame issue (May 2022)

and asked MS answers forum moderators to forward the issue to the responsible Microsoft product group. Microsoft has to fix that issue.

Addendum (2022/05/05): The issue has been fixed - see the post from Microsoft Answers Forum:

Shyamal Debnath – MSFT
Microsoft Agent | Moderator
Replied on May 5, 2022
Hi All,
This issue was posted to the Service Health Dashboard (SHD) as incident EX375556, Start time: Monday, May 2, 2022, at 8:57 PM UTC.
User Impact: Users are repeatedly prompted to download "TokenFactoryIframe" when browsing Outlook on the web via Safari on Mac OS.
More info: Users report seeing the same download prompt when accessing office.com as well from the Safari browser.
Current status: The deployment of the fix has completed in the majority of the environments, and we've confirmed with some reporting users that the impact is remediated. We're continuing to monitor the progression of the fix as it finishes deploying to ensure the issue is resolved for all remaining environments.
Tenant administrators can view current information and updates on SHD at the link here https://portal.office.com/AdminPortal/Home#/servicehealth
For affected customers to easily identify the information here, this thread will be closed. We will update to the thread once the issue is resolved or you can obtain the most recent information from SHD.
Your patience and cooperation are highly appreciated.
Best regards,
Shyamal

[#6]

I been having the same issue since yesterday (5/3/22). Is there a work around?

@Günter Born 

[#7]

See the mentions within the article - the best is to use Firefox to access your OWA account.

[#8]

I have been able to replicate this issue and found that you can stop the Safari Downloads by going to Safari/Preference/Websites/Downloads and select "DENY" for Configured Websites - Outlook and or Office.com. This will stop the "TokenFactoryiFrame" from auto downloading evey 10 secs or so. Now this is just a temp fix until "Micorsoft" finds the issue and offers a resolution. Good Luck and hope this info helps!

[#9]

@Dhuinda I too, am suddenly having this issue.  Its alarming to say the least. 

[#10]

Thank you - that worked for now.

[#11]

Yes for 2 days now. Thought it was malware. Hope it isn't. Very annoying and distracting. What does it even mean?

[#12]

@Dhuinda What is Token Factory iFrame Download on Safari, Mac, Outlook When you log into my working view created in Mac operating system and (token factory iframe) continues to download token factory iframe, error. Microsoft officials have not yet said anything about this, whether it is an error or on purpose.

SOURCE: https://chicagopopular.com/what-is-token-factory-iframe-download-on-safari-mac-outlook/

[#13]

https://howtoremove.guide/token-factory-iframe-mac/

What is Token Factory Iframe?
Token Factory Iframe is a page-redirecting app that will immediately begin to reroute your web traffic the moment it gets installed in your browser. Token Factory Iframe has been categorized as a browser hijacker that aims to aggressively promote sponsored sites on the user’s screen.

The main activity of these apps is related to online advertising and, for as long as they operate on your computer, most Browser Hijackers will only spam you with different sponsored ads, pay-per-click messages, pop-ups, banners, and redirects to predefined web pages. A real virus, on the other hand, is a threat that would do much more than simply spam your screen with commercials. For instance, a Ransomware infection can not only sneak in the system without any visible symptoms, but it can render your files inaccessible until you pay a ransom for them. A program like Token Factory Iframe is far less problematic and will never do such a thing, even if it tends to be extremely annoying and unpleasant to have in your browsing program.

[#14]

Two remarks about the posts above - just a kind of care: The suggestion from @Luchotamblay to block downloads is surely a workaround - but as I wrote within my article, you are no longer able to download mail attachments. If you are affected, use Firefox as a temporary workaround - as I suggested within my original article.

The second suggestion from @Luchotamblay with the link to howtoremove guide should be taken with care (I would not post this external link in MS forums without a warning). After the initial incident reported above - and after I wrote my initial article - several sites also created an article "what is Token Factory Iframe" - and explain it as a browser hijacker. While that's probably not false, all sites offers a "free" removal tool.

I just read the terms of use of their "free removal tool" - they try to trick incautious users to a subscription of 48 € (or $) for 6 months. Imho suspicious ...

I have not seen (till yet) any report about an infection of a browser hijacker in the current case (although users has checked their macOS systems and browsers with tools like Bitdefender).

[#15]

Thank You

[#16]

I got today a feedback from a German blog reader, that the issue has been fixed by Microsoft. I haven't found a confirmation till yet. Can somebody confirm that? I can't test it (no Mac, no iPad, no Office 365/MS 365). See also my addendum a few comments above. 

[#17]

It seems to have stopped at this time for me.

[#18]

We have discovered the same issue on iPads using the Chrome browser.@Dhuinda