{
  "family": "gamium",
  "sample_count": 1,
  "category": "advanced_threat",
  "description": "<h3>Executive Summary</h3>\nGamium is a Potentially Unwanted Program (PUP) and adware variant that specifically targets the monetization of the user's web browsing activity. It is characterized by its intrusive advertising techniques and its ability to significantly degrade the user experience while collecting unauthorized behavioral data.\n\n<h3>Infection Vector and Operational Tactics</h3>\nGamium almost exclusively relies on \"bundling\" as its primary distribution method. It is hidden within the installation wizards of legitimate, often open-source, software downloaded from untrustworthy hosting sites. \n\nUpon successful installation, Gamium integrates deeply with the operating system. It deploys dynamic link libraries (DLLs) that hook into the user's web browsers, monitoring HTTP and HTTPS traffic. The adware excels at displaying persistent pop-under ads, banner injections, and hyperlink modifications (turning regular text on websites into sponsored links). Gamium maintains a constant connection to its command-and-control servers, downloading updated blacklists of security software to evade detection and fetching new advertising payloads tailored to the user's tracked interests.\n\n<h3>Threat Impact</h3>\nGamium poses a severe risk to data privacy. It aggressively harvests user telemetry, which is often transmitted in plaintext or weak encryption to third-party servers. The adware's hooking mechanisms can also cause browser instability, leading to frequent crashes and a severe reduction in system responsiveness.\n\n<h3>Mitigation Best Practices</h3>\n<ul>\n<li><strong>Software Procurement:</strong> Enforce strict policies requiring employees to download software exclusively from official vendor websites or approved enterprise software portals.</li>\n<li><strong>Endpoint Scans:</strong> Conduct thorough heuristic scans using enterprise-grade anti-malware solutions to detect Gamium's obfuscated DLLs.</li>\n<li><strong>Host Intrusion Prevention Systems (HIPS):</strong> Utilize HIPS to monitor and block unauthorized DLL injections into browser processes.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Adware.Gamium",
    "PUP.Gamium",
    "Win32/Gamium"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1566.002",
    "T1055.001",
    "T1112"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T16:00:59Z",
  "type": "Adware",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}