{
  "family": "installiq",
  "sample_count": 6,
  "category": "advanced_threat",
  "description": "Adware:Win32/Installiq is a massive, commercial Pay-Per-Install (PPI) bundler framework, functioning similarly to Installmonetizer. It is essentially an aggressive distribution engine utilized by hundreds of different Potentially Unwanted Programs (PUAs). Its core objective is to act as a deceptive 'wrapper' around legitimate, highly sought-after freeware, tricking users into simultaneously installing highly intrusive browser hijackers, fake system optimizers, and tracking toolbars to generate affiliate revenue.<br><br><b>Understanding Installiq</b><br>To an end-user, Installiq is the convoluted installation wizard they must navigate to get their free software. For a corporate IT Helpdesk, Installiq is a major operational headache, responsible for a massive influx of 'browser hijacked' and 'pop-up ads' tickets. It represents a significant failure in endpoint Application Control, allowing unvetted, potentially vulnerable applications to saturate the network.<br><br><b>Execution and Dark Patterns</b><br>Installiq thrives on deceptive UI design, known as 'Dark Patterns' (`T1204.002`). During installation, it presents pre-checked boxes, confusing 'Decline' vs 'Cancel' buttons, and hidden 'Custom Installation' menus to trick the user into granting consent for secondary payloads (`T1189`). Once running, it acts as a dynamic downloader (`T1105`). It contacts its PPI network infrastructure, assesses the target's operating system, and downloads the highest-paying adware payloads. It then silently installs these payloads (BHOs, extensions, registry hooks) (`T1176`) in the background while the user waits for the main freeware installation to complete.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the introduction of multiple, disparate secondary adware infections, severely degrading system performance and violating user privacy. IoCs include EDR alerts for unsigned installer executables dropping numerous MSIs and EXEs into the `%Temp%` directory. Network logs will show bursts of HTTP/HTTPS traffic to known PPI distribution networks (often dynamically generated subdomains) during the software installation phase.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1204.002",
    "T1176",
    "T1105",
    "T1189"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Deceptive software bundling)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File (User running the wrapper)",
      "tactic": "Execution"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (Downloading the adware payloads)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions (Installing the hijacked toolbars)",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Do not just uninstall the initially requested freeware; you must identify and meticulously uninstall all the secondary payloads dropped by Installiq.",
    "Deploy an enterprise PUA/Adware removal tool (like Malwarebytes or AdwCleaner) to clean the deeply embedded registry hooks and force-installed extensions.",
    "Implement strict Application Control (AppLocker/WDAC) to block users from executing unsigned installers from the `%Downloads%` directory.",
    "Educate users on the dangers of third-party software portals and the deceptive use of 'Dark Patterns' in installers."
  ],
  "what_to_avoid": [
    "Avoid assuming a single AV scan will clean the machine; PPI bundlers drop *multiple* different adware families, requiring comprehensive cleanup.",
    "Do not allow users local administrative privileges, as this is required for the bundler to install system-wide browser hijackers."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}