Not long after posting the question the browser in the VM starting to report the same thing.
From "How does Phishing and Malware Protection work in Firefox?" located here
Phishing and Malware Protection works by checking the sites that you visit against lists of reported phishing, unwanted software and malware sites. These lists are automatically downloaded and updated every 30 minutes or so when the Phishing and Malware Protection features are enabled. The technical details of the safe-browsing protocol are also publicly available.