{
  "family": "ytddownloader",
  "sample_count": 23,
  "category": "advanced_threat",
  "description": "Adware:Win32/YTDDownloader (also known as YTD Video Downloader) is a widespread Potentially Unwanted Application (PUA) and adware framework. While its advertised function—downloading videos from YouTube and other sites—may work, the software is aggressively monetized by bundling highly intrusive adware, browser hijackers, and tracking cookies.<br><br><b>Understanding YTDDownloader</b><br>To the average user, YTDDownloader seems like a useful free tool. However, the installation process is deeply deceptive. It utilizes 'Dark Patterns'—pre-selected checkboxes hidden under 'Custom Installation' menus—to gain technical consent to install secondary software. For security analysts, this application acts as a conduit (or 'wrapper') that introduces significant privacy and security risks into the enterprise environment by forcefully altering browser configurations and injecting affiliate advertisements into web traffic.<br><br><b>Execution and Adware Injection</b><br>YTDDownloader is distributed directly from its official site or via third-party freeware download portals (`T1189`). During installation, it frequently drops secondary adware payloads (like Spigot, SearchProtect, or Websearch). These secondary payloads modify the default search provider in Chrome, Firefox, and Edge (`T1112`) and install malicious Browser Helper Objects (BHOs) or extensions (`T1176`). It establishes persistence via Registry Run keys (`T1547.001`) to ensure the adware components restart upon reboot and uses Scheduled Tasks to check for and reinstall removed extensions.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a degraded user experience, wasted helpdesk resources responding to 'slow browser' complaints, and the exfiltration of user browsing habits to third-party ad networks. Network logs will show search traffic redirected through affiliate tracking domains. EDR platforms should flag the unauthorized modification of browser `Preferences` files and the installation of untrusted extensions.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1189",
    "T1547.001",
    "T1562.001",
    "T1112",
    "T1176"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the active exfiltration of browsing telemetry and the downloading of further adware modules.",
    "Use the standard Windows uninstaller to remove 'YTD Video Downloader', but anticipate that the bundled adware will remain.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to locate and strip the deeply embedded registry hooks (BHOs) and watchdog services.",
    "Force a complete reset of all installed web browsers to factory defaults to eradicate the rogue extensions and restore the homepage."
  ],
  "what_to_avoid": [
    "Do not allow users to install 'free' media downloaders on corporate assets, as they are a primary vector for PUA infections.",
    "Avoid assuming a standard uninstall cleans the system; the monetization comes from the bundled adware, which is designed to persist."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}