{
  "family": "hijacker",
  "sample_count": 92,
  "category": "advanced_threat",
  "description": "BrowserModifier:Win32/Hijacker is a broad heuristic classification for Potentially Unwanted Programs (PUPs), adware, and malicious extensions specifically engineered to forcibly alter web browser configurations without user consent for affiliate monetization.<br><br><b>Understanding Hijacker</b><br>For the average user, a Hijacker detection explains why their homepage suddenly changed to an unfamiliar search engine (like 'Conduit' or 'SearchProtect') and why they cannot change it back. For security analysts, 'Hijacker' is a behavioral signature identifying software that leverages aggressive persistence mechanisms to lock browser settings, harvesting search queries and redirecting traffic to generate advertising revenue.<br><br><b>Execution and Evasion Strategies</b><br>Hijackers are almost exclusively distributed via deceptive software bundlers (Pay-Per-Install networks). Upon execution, the installer drops malicious extensions across all installed browsers (Chrome, Edge, Firefox). Crucially, to prevent the user from simply uninstalling the extension, the Hijacker employs defense evasion. It frequently leverages Windows Group Policy (GPO) settings (e.g., `ExtensionInstallForcelist`) to 'lock' the extension, grays out the removal button in the browser UI, modifies the browser's shortcut properties to append malicious URLs, and establishes a watchdog Windows Service to instantly revert any changes the user manages to make.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a degraded user experience, wasted helpdesk time, and a total loss of browsing privacy. Incident responders will observe anomalous HTTP/HTTPS traffic to known ad-tracking networks. EDR logs will clearly show the initial installer modifying browser preference files (e.g., Chrome's `Preferences` JSON) and establishing unauthorized Group Policies.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1543.003",
    "T1189",
    "T1562.001",
    "T1176",
    "T1112"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the active exfiltration of browsing telemetry and the downloading of further adware modules.",
    "Audit Windows Group Policies and the Registry to remove any forced extension installation policies created by the hijacker.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to locate and strip the deeply embedded registry hooks and watchdog services.",
    "Check all browser desktop shortcuts (Right Click -> Properties) and remove any malicious URLs appended to the 'Target' field."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's native 'remove extension' button; Hijackers are explicitly designed to bypass or disable this functionality.",
    "Avoid ignoring the infection; the tracking infrastructure actively harvests browsing habits, which may include access to sensitive portals."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}