{
  "family": "websearch",
  "sample_count": 26,
  "category": "advanced_threat",
  "description": "BrowserModifier:Win32/Websearch is a highly prevalent browser hijacking framework and Potentially Unwanted Program (PUA) that forcibly alters a user's web browser configuration to redirect search traffic through affiliate networks, generating illicit advertising revenue.<br><br><b>Understanding Websearch</b><br>To the victim, a Websearch infection is intensely frustrating. Their preferred homepage (e.g., Google or Bing) is replaced with a deceptive search portal (often mirroring the look of a legitimate engine). Every search query they enter is routed through tracking domains, exposing them to injected advertisements and potentially malicious search results. For a security analyst, Websearch represents a significant privacy violation and a vector for further infections, as the forced search results frequently lead to malware droppers.<br><br><b>Execution and Hijacking Strategies</b><br>Websearch is primarily distributed through deceptive software bundling (`T1189`). When a user installs freeware, the Websearch installer runs silently in the background. It aggressively modifies browser settings across Chrome, Firefox, Edge, and IE. It changes the default search provider registry keys (`T1112`) and installs malicious browser extensions (`T1176`) to lock the settings in place. To ensure the user cannot easily revert the changes, it frequently deploys Windows Group Policy Objects (GPOs) or sets up scheduled tasks that act as a 'watchdog', reinstalling the extension if the user attempts to remove it.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a degraded user experience, loss of browsing privacy, and increased risk of secondary infections from malicious ads. Network logs will show all HTTP/HTTPS search traffic being redirected through unknown, third-party affiliate domains. EDR platforms should flag the unauthorized modification of browser preference files and the creation of restrictive GPOs by an untrusted installer.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1189",
    "T1053.005",
    "T1176",
    "T1112",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the active redirection of search traffic and the potential downloading of secondary malware via malicious ads.",
    "Audit Windows Group Policies (`gpedit.msc`) and the Registry to remove any forced extension installation policies created by the hijacker.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to locate and strip the deeply embedded registry hooks and watchdog services.",
    "Force a complete reset of all installed web browsers to factory defaults to eradicate the rogue extensions and restore the homepage."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's 'remove extension' button; Websearch uses GPOs and watchdog services to immediately reinstall itself.",
    "Avoid ignoring the infection; the redirected search traffic can expose corporate data if the user queries internal project names."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}