{
  "family": "tasker",
  "sample_count": 36,
  "category": "advanced_threat",
  "description": "Adware:Win32/Tasker is a deceptive adware framework and Potentially Unwanted Program (PUA) that silently infiltrates endpoints, typically bundled with freeware, to inject intrusive advertisements, hijack browser settings, and harvest user search telemetry for affiliate monetization. It is specifically named for its heavy reliance on Windows Scheduled Tasks to maintain persistence.<br><br><b>What is Tasker?</b><br>To the average user, Tasker is highly visible and deeply frustrating. The browser homepage is forcibly changed, default search engines are locked to unfamiliar domains, and standard websites are flooded with injected banner ads or in-text hyperlinks. For security analysts, Tasker operates on the Pay-Per-Install (PPI) model. It leverages deceptive installation tactics and aggressive persistence mechanisms (primarily abusing `schtasks.exe`) to ensure the user cannot easily revert their browser settings, guaranteeing continued revenue generation for the attackers.<br><br><b>Infection Vectors & Threat Hunting</b><br>Tasker is almost exclusively distributed via deceptive software bundlers. When a user downloads a free PDF editor or media player from a third-party site, the Tasker wrapper executes first. Upon execution, it installs malicious browser extensions and utilizes Windows Group Policy (GPO) settings to lock the rogue extensions in place. It establishes deep persistence via the Task Scheduler (`T1053.005`), often creating multiple hidden tasks configured to trigger on boot, on user logon, or at specific time intervals to reinstall the adware if the user manages to delete the core files.<br><br><b>Forensic Analysis & Impact</b><br>The primary impact is a severely degraded user experience, compromised browsing privacy, and wasted helpdesk resources. EDR platforms will frequently flag the execution of `schtasks.exe` attempting to create tasks that point to randomized executables in the `%AppData%` or `%Temp%` directories. Incident responders will also observe anomalous HTTP/HTTPS traffic to known ad-tracking networks.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1112",
    "T1176",
    "T1562.001",
    "T1053.005",
    "T1189"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the active exfiltration of browsing telemetry and the downloading of further adware modules.",
    "Thoroughly audit the Windows Task Scheduler (`schtasks.exe` or `taskschd.msc`) to identify and manually delete the persistence mechanisms.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to locate and strip the deeply embedded registry hooks and watchdog services.",
    "Force a complete reset of all installed web browsers to factory defaults to eradicate the rogue extensions and restore the homepage."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's 'remove extension' button; Tasker's Scheduled Tasks will immediately reinstall the adware upon the next trigger.",
    "Avoid ignoring the infection; adware tracking data is highly detailed and may expose corporate activities or access to internal portals."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}