Addmepoint

Overview

Adware:Win32/Addmepoint is a specialized adware and social media hijacking tool designed to forcibly manipulate a user's web browser and social media accounts. Its primary goal is to fraudulently inflate 'Likes', 'Followers', or views on specific social media platforms (like Facebook, Twitter, or YouTube) by utilizing the infected victim's authenticated sessions without their consent (`T1189`).

Understanding Addmepoint (Social Hijacking)
To an end-user, Addmepoint might cause their browser to slow down, and they may notice their social media accounts suddenly following unknown people, joining random groups, or 'liking' bizarre posts. For an IT department, Addmepoint represents a significant privacy and credential theft risk, as the malware has direct access to the user's active session cookies.

Execution and Hijacking Mechanics
Addmepoint is typically distributed via deceptive software bundles (Pay-Per-Install networks). Upon execution, it installs a malicious browser extension (Chrome, Firefox, Edge) to establish persistence (`T1176`). Because the extension operates within the browser context, it inherently bypasses multi-factor authentication (MFA). It utilizes Cross-Site Scripting (XSS) techniques or directly interacts with the social media platform's API using the victim's stolen session cookies (`T1539`). It forces the browser to silently navigate to target pages and perform automated actions in the background.

Indicators of Compromise & Impact
The primary impact is the compromise of the user's digital identity and the unauthorized use of their accounts for click-fraud. Host-based IoCs include the presence of unwanted browser extensions (often hiding under generic names), unauthorized modifications to browser shortcut files (`.lnk`), and unexpected background processes. Network IoCs involve the browser making high-volume, automated HTTP requests to social media APIs that do not correlate with the user's active browsing behavior.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_ADDMEPOINT {
    meta:
        description = "Detects Addmepoint (advanced_threat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "addmepoint" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Addmepoint Activity
id: 36bf86f121092592c7ba90da1bf87875
status: experimental
description: Detects generic indicators of the addmepoint malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*addmepoint*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Force a sign-out of all active social media and web sessions to invalidate the stolen cookies.
2. Use a reputable anti-malware tool to locate and remove the Addmepoint executables and malicious browser extensions.
3. Reset all web browsers to their default settings to remove any forced proxy configurations or persistent scripts.
4. Advise the user to review their social media activity logs and revoke any 'Likes' or 'Follows' they did not authorize.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume that changing the account password will immediately stop the activity; you must invalidate the active session cookies.
2. Avoid relying solely on the browser's extension manager to remove the threat, as Addmepoint often uses background services to reinstall the extension.

References & External Analysis

• Search "addmepoint" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: advanced_threat)

Explore other malware families in the same category:

• Spyboter
• Keyer
• Pupstudio
• Downloadadmin
• Openinstall

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/addmepoint.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.