{
  "family": "searchpage",
  "sample_count": 17,
  "category": "advanced_threat",
  "description": "BrowserModifier:Win32/Searchpage is a classification for a vast array of aggressive browser hijackers that forcefully alter a user's web browser configuration, specifically targeting the homepage, new tab page, and default search engine, to redirect all web traffic through affiliate marketing or ad-revenue networks.<br><br><b>Understanding Searchpage Hijackers</b><br>To an end-user, a Searchpage infection results in a deeply frustrating browsing experience where they are unable to navigate to their intended search engine (like Google or Bing). Instead, they are constantly redirected to low-quality, unfamiliar search portals filled with sponsored links. For security analysts, Searchpage variants are low-severity but high-volume threats. They rely on aggressive persistence techniques to ensure the user cannot undo the changes via the browser's settings menu, ensuring continuous ad revenue generation.<br><br><b>Execution and Hijacking Mechanics</b><br>Searchpage variants are typically installed silently via software bundling (`T1189`). During the installation of a freeware program, the hijacker executes and drops malicious browser extensions (`T1176`) or modifies core browser preference files (such as Chrome's `Preferences` or Firefox's `prefs.js`). To prevent the user from reversing the changes, advanced variants modify the Windows Registry (`T1112`), specifically altering shortcut files (`.lnk`) on the desktop or taskbar to append the malicious URL as an argument to the browser executable (`T1546`). They may also leverage Windows Group Policy Objects (GPOs) to force-install the extension enterprise-wide.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is primarily a loss of productivity, a degraded user experience, and the potential exfiltration of search history telemetry. Incident responders will observe anomalous DNS and HTTP traffic routing to known hijacker domains. EDR logs will flag unauthorized modifications to browser shortcut files or the creation of local GPOs related to browser extension whitelists.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1562.001",
    "T1546",
    "T1112",
    "T1189",
    "T1176"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1546",
      "name": "Event Triggered Execution: Browser Shortcut Modification",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Use enterprise endpoint management tools to forcefully remove the rogue browser extensions and reset the default search providers.",
    "Audit the properties of all browser shortcuts (`.lnk` files) on the user's Desktop, Taskbar, and Start Menu to remove any appended malicious URLs.",
    "Check the local Group Policy Editor (`gpedit.msc`) for any policies enforcing the installation of specific extensions, and delete them.",
    "Deploy specialized adware removal tools (e.g., AdwCleaner) to locate and strip any deeply embedded registry hooks or watchdog services."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's internal 'reset' button; many hijackers use watchdog services to immediately re-apply the malicious settings.",
    "Avoid ignoring the infection, as the affiliate networks powering these hijackers often serve malicious advertisements (malvertising) that can lead to more severe infections."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}