I have come to the conclusion that Microsoft IS the virus. However, I am left with a non-standard - non-kiosk Chrome instance. Fortunately, the Barracuda blocks the page, as it was supposed to do. This takes the browser out of kiosk mode.
Recently, some of our thin clients started opening an extra tab which tries to reach msn.com. This has been working without a hitch for the last year-ish. I have an HP Windows 10 thin client which runs Google Chrome to open an on-prem web site in kiosk mode (On boot up).
