{
  "family": "mybeesearch",
  "sample_count": 9,
  "category": "advanced_threat",
  "description": "BrowserModifier:Win32/Mybeesearch is an aggressive Potentially Unwanted Program (PUA) and browser hijacker. Its primary objective is to silently take control of the user's web browsers, forcibly altering the default homepage, new tab page, and default search engine to the 'Mybeesearch' portal (or affiliate sites). It monetizes this hijack by injecting intrusive advertisements into search results and aggressively tracking the user's browsing telemetry to sell to third-party ad networks.<br><br><b>Understanding Mybeesearch Adware</b><br>To an end-user, a Mybeesearch infection is highly frustrating. Their familiar Google or Bing search engine is suddenly replaced by an unknown portal, their browser becomes sluggish, and they are bombarded with irrelevant, often deceptive banner ads. For security analysts, it represents a classic Pay-Per-Install (PPI) monetization scheme, utilizing rootkit-like persistence to prevent the user from easily reverting their browser settings.<br><br><b>Execution and Hijacking Mechanics</b><br>Mybeesearch is almost exclusively distributed via deceptive software bundlers (`T1189`) found on third-party freeware sites. Upon execution, the installer uses 'Dark Patterns' to bypass user consent (`T1204.002`). It establishes aggressive persistence via hidden Windows Services and multiple Registry Run keys. It installs rogue Browser Helper Objects (BHOs) and extensions (`T1176`) into Chrome, Edge, and Firefox to intercept all web traffic (`T1185`). Crucially, it modifies browser preference files (like Chrome's `Preferences` JSON) and sometimes leverages Windows Group Policy (GPO) to lock the rogue settings in place (`T1562.001`), preventing the user from removing the extension manually.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severely degraded user experience, compromised browsing privacy (all searches are tracked and monetized), and wasted helpdesk resources. Incident responders will observe anomalous HTTP/HTTPS traffic routing through known adware tracking networks. EDR logs will flag the installation of the Mybeesearch extensions and the persistent, unauthorized modification of browser registry keys and GPOs.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1189",
    "T1112",
    "T1176",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Bundled Installers)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions (BHO installation)",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry (Search and Homepage Hijacking)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (GPO Abuse)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Use the Windows Control Panel to attempt uninstallation, but be aware the uninstaller often leaves the core watchdog services intact.",
    "Audit Windows Group Policies and the Registry to remove any forced extension installation policies created by the adware.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner or Malwarebytes) to locate and strip the deeply embedded registry hooks, BHOs, and Windows Services.",
    "Force a complete reset of all installed web browsers to factory defaults to eradicate the rogue extensions and restore the homepage."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's 'remove extension' button; the underlying watchdog service or GPO will immediately reinstall the hijacker.",
    "Avoid ignoring the infection; adware tracking data is highly detailed and may expose corporate activities or provide a foothold for malvertising."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}