{
  "family": "browshot",
  "sample_count": 1,
  "category": "trojan",
  "description": "Trojan:Win32/Browshot (or BrowserHijack) acts as a highly aggressive Adware component or a secondary payload designed to completely subvert the victim's web browsing experience (`T1189`). While it may occasionally steal browsing history, its primary malicious function is monetizing the infection by forcibly redirecting web traffic, injecting advertisements, and manipulating search results to funnel traffic to attacker-controlled affiliate sites.<br><br><b>Understanding Browshot (Browser Hijacking)</b><br>To an end-user, the computer may feel normal, but their browser is broken: their homepage is changed, default search engines are replaced with obscure variants (like 'SearchProtect'), and intrusive ads appear on every site. For a SOC, a Browshot infection indicates that the user's endpoint defenses failed, often due to user execution of bundled 'freeware' or a successful drive-by download.<br><br><b>Execution and Persistence Mechanics</b><br>Browshot variants often bypass simple browser extensions. They achieve persistence by modifying the shortcut icons (`.lnk` files) on the desktop or taskbar, appending malicious URLs to the browser executable path (`T1547.009`). They also inject malicious DLLs into the browser process (Chrome, Edge, Firefox) itself (`T1055.001`), allowing them to intercept and rewrite HTTPS traffic *before* it is encrypted by the browser.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severe loss of user productivity and the continuous risk of secondary infections via malvertising. Host-based IoCs include modified browser shortcut files, the presence of unknown, unsigned DLLs loaded into browser processes, and unauthorized modifications to the `HKCU\\Software\\Policies\\Google\\Chrome` registry keys (forcing enterprise policies on a home user). Network IoCs include a constant stream of background HTTP traffic to advertising trackers.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1189",
    "T1055.001",
    "T1547.009"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1547.009",
      "name": "Boot or Logon Autostart Execution: Shortcut Modification (Altering browser shortcuts)",
      "tactic": "Persistence"
    },
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection (Hooking the browser to intercept traffic)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise (The typical delivery method for browser hijackers)",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Use dedicated anti-malware tools (like AdwCleaner) to scan for deeply embedded browser hooks and malicious registry policies.",
    "Inspect and manually fix all browser shortcuts on the desktop, Start Menu, and Taskbar.",
    "Perform a complete reset of all installed browsers to clear malicious extensions, search providers, and hijacked homepages.",
    "Check for unauthorized Proxy configurations set in the Windows Internet Options."
  ],
  "what_to_avoid": [
    "Do not rely solely on uninstalling the 'freeware' that brought the hijacker; the adware components usually leave persistence mechanisms behind.",
    "Avoid ignoring the alert; adware networks frequently pivot to serving ransomware if the host appears vulnerable."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}