{
  "family": "codecpa",
  "sample_count": 2,
  "category": "trojan",
  "description": "Adware/Trojan:Win32/Codecpa is a deceptive classification of malware that masquerades as a required video or audio codec (e.g., 'You must download this codec to view the video'). Instead of providing media playback capabilities, it silently installs aggressive adware, browser hijackers, and potentially infostealers on the victim's machine (`T1036`).<br><br><b>Understanding Codecpa (Fake Codecs)</b><br>To an end-user, the infection begins with frustration when trying to watch a video online, usually on unofficial streaming or adult sites, leading them to willingly download and run the malicious installer. For security teams, Codecpa represents a classic social engineering tactic that exploits user desire for content to bypass technical defenses. While often categorized as adware, these 'codecs' frequently serve as droppers for much more severe threats.<br><br><b>Execution and Deception Mechanics</b><br>The attack vector is almost entirely web-based (`T1189`). Malicious websites detect the user's browser and serve a fake error message (e.g., 'Missing Codec 0x48f'). When the user runs the downloaded `setup_codec.exe`, it may briefly display a fake installation progress bar. In the background, it alters browser shortcut icons, changes the default search engine, and injects ad-serving DLLs into the browser process. To establish persistence, it creates scheduled tasks or registry run keys to ensure the adware components load every time the user logs in (`T1547.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a degraded user experience, browser hijacking, and exposure to further malvertising. Host-based IoCs include new browser extensions installed without user consent, modified browser shortcuts (where the 'Target' field has been appended with a malicious URL), and EDR alerts for known adware executables running from `%AppData%` or `%LocalAppData%`. Network IoCs involve heavy background HTTP/HTTPS traffic to known adware tracking and deployment domains.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1547.001",
    "T1036",
    "T1189"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1036",
      "name": "Masquerading (Disguising the malware installer as a legitimate video/audio codec)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Distributing the fake codec via malicious streaming sites)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (Persistence)",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Run a comprehensive scan with a reputable adware/malware removal tool to strip out the persistent components and malicious browser extensions.",
    "Reset all installed web browsers to their default settings to remove any lingering homepage or search engine hijackers.",
    "Audit and correct any modified Windows shortcuts (.lnk files) pointing to web browsers on the desktop or taskbar.",
    "Implement web filtering (DNS or proxy-based) to block access to known malvertising and fake software update domains."
  ],
  "what_to_avoid": [
    "Do not instruct users to simply 'uninstall the extension', as the underlying Codecpa service will reinstall it upon the next reboot.",
    "Avoid downloading media playback software from untrusted sources; rely on established players like VLC which have built-in codec support."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}