I am attempting to troubleshoot an issue with users receiving Microsoft Defender phishing hoax popups on user endpoints. The issue seems to happen when users are doing normal web browsing.