Microsoft to detect and remove adware that uses man-in-the-middle techniques, like Superfish, beginning in March, will only allow adware as browser plugins
Context & Ripple Effects
This policy formalizes what began as emergency cleanup: after the Lenovo Superfish scandal, Microsoft pushed Windows Defender updates to strip the pre-installed software, and its removal tools had cleared Superfish adware from 250K Lenovo PCs by early March. By April it was also warning users in Internet Explorer about malicious ads.
What changes now is that remediation becomes standing policy rather than incident response: any adware using man-in-the-middle certificate interception gets detected and removed automatically, and the only tolerated form of adware becomes a conventional browser plugin.
First-order effects
- Adware vendors relying on traffic interception — the Superfish model — face automatic removal from Windows starting in March, ending that technique as a viable distribution method on the platform.
- Legitimate ad-supported software must re-engineer itself as a browser plugin or lose its removal protection under Microsoft's criteria.
Second-order effects
- PC makers lose cover for pre-installed monetization software: what Microsoft removed manually from Lenovo machines now gets flagged by default, raising the reputational cost of shipping such bundles.
- Security tooling shifts toward detecting network-level interception generally, since the same technique serves both adware and credential theft — a line later blurred when Microsoft tracked the [[a:960917|Adrozek campaign injecting ads into Chrome, Firefox and Edge while altering security settings]].
Third-order effects
- The boundary Microsoft draws here — interception techniques are malware regardless of intent, plugin-based advertising is tolerable — becomes the template for how platform vendors police ad injection across browsers they don't own.
- OEM bundling economics erode: if the platform vendor removes monetization preloads automatically, manufacturers lose one of the few revenue sources attached to low-margin Windows hardware.
The trend: Platform owners are absorbing adware defense into default OS behavior, moving from one-off cleanups like Superfish to permanent classification of interception-based ad injection as malware.