{
  "family": "webdiscover",
  "sample_count": 3,
  "category": "advanced_threat",
  "description": "Adware:Win32/Webdiscover is a highly persistent, intrusive Potentially Unwanted Program (PUP) and **Browser Hijacker** that specifically manifests as an unremovable search bar anchored to the top of the Windows desktop. While it brands itself as a convenient Chromium-based search tool, its true purpose is to forcibly hijack user search traffic, inject advertisements, and generate illicit affiliate revenue for its creators.<br><br><b>Understanding Webdiscover</b><br>To an end-user, Webdiscover is extremely frustrating. It overlays a persistent search bar on the desktop that cannot be closed through normal UI methods, and it forcibly changes the default search engine in all installed browsers (Chrome, Edge, Firefox). For a security team, it represents a breakdown in endpoint hygiene and a vector for privacy violations, as every search query is logged and routed through adware tracking infrastructure.<br><br><b>Execution and Hijacking Mechanics</b><br>Webdiscover is heavily distributed via deceptive software bundles or fake updates (like fake Flash or Java installers) (`T1189`). Upon execution with administrative privileges (`T1204.002`), it establishes deep persistence. It installs a system service (`T1543.003`) and modifies the Registry Run keys (`T1547.001`) to ensure the desktop search bar launches immediately upon boot. It aggressively modifies browser configuration files, shortcut properties (`T1546`), and installs persistent browser extensions (`T1176`). To protect itself, Webdiscover often includes watchdog processes that actively monitor for attempts to uninstall it or revert browser settings, immediately reinstating the hijacked configuration if tampering is detected (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a degraded user experience, resource consumption, and privacy loss. Host-based IoCs include EDR alerts for the presence of the `WebDiscoverBrowser.exe` process, the creation of a 'WebDiscover' folder in `Program Files`, and unexpected modifications to browser shortcut targets (appending the adware's URL). Network IoCs include DNS queries resolving to the Webdiscover backend (often `search.webdiscoverbrowser.com` or similar tracking domains) and all web search traffic being forcibly redirected through affiliate links.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1562.001",
    "T1547.001",
    "T1176",
    "T1189"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions (Installing malicious toolbars/hijackers)",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Reverting browser setting changes)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Use Task Manager to locate and forcibly terminate all processes related to 'Webdiscover' before attempting uninstallation.",
    "Use the Windows Control Panel to uninstall the 'WebDiscover Browser' application.",
    "Inspect the properties of all browser shortcuts on the desktop and taskbar, and remove the Webdiscover URL from the 'Target' field.",
    "Reset all installed web browsers to their default settings and run a thorough scan with an enterprise-grade Adware/PUA removal tool to clean up remaining registry keys and extensions."
  ],
  "what_to_avoid": [
    "Do not simply try to hide the search bar or manually change the homepage; the watchdog service will immediately revert your changes.",
    "Avoid allowing users to download software from unverified third-party portals, as this is the primary vector for aggressive adware."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}