Adware:Win32/Linkury is a massive, highly organized adware and click-fraud network that aggressively monetizes infected endpoints through forced advertisements and traffic redirection.
Understanding Linkury
To the end-user, Linkury renders a computer nearly unusable by injecting in-text hyperlinks, pop-up ads, and fake security warnings into every visited webpage. For security analysts, Linkury represents a severe compromise of the browser's security boundary. It acts as a Man-in-the-Browser (MitB), utilizing local proxies and rogue root certificates to intercept and decrypt SSL/TLS traffic, allowing it to inject ads even on secure HTTPS sites.
Execution and Evasion Strategies
Linkury is distributed via pay-per-install (PPI) software bundlers. Once installed, it drops its Smartbar (or similar toolbars) and rogue extensions across all browsers. It establishes persistence by modifying the Windows Internet Options to route all traffic through a local proxy (usually 127.0.0.1) controlled by the adware. It protects its components by installing a Windows Service that actively monitors the registry; if a user attempts to remove the proxy settings, the service instantly reverts them.
Indicators of Compromise (IoCs)
Incident responders should immediately audit the Windows Certificate Store for unauthorized, self-signed Root CAs, which Linkury uses to facilitate its HTTPS interception. Threat hunters will find anomalous proxy configurations in the registry (HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings). Network logs will reveal massive volumes of HTTP GET requests directed at known ad-tracking and affiliate networks.
Observed techniques used by this family, mapped to the MITRE ATT&CK framework:
These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.
rule MALWARE_WIN_LINKURY {
meta:
description = "Detects Linkury (adware)"
author = "SystemHelpdesk Boilerplate Generator"
date = "2026-07-06"
strings:
$s1 = "linkury" ascii wide nocase
condition:
uint16(0) == 0x5a4d and any of them
}title: Suspicious Linkury Activity
id: af35fdbca9f815ee93c4740ce7296349
status: experimental
description: Detects generic indicators of the linkury malware family.
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
CommandLine|contains:
- "*linkury*"
condition: selection
level: mediumOrdered checklist for responders. Adapt to your environment and engage professional support for active incidents.
Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.
Explore other malware families in the same category:
Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/linkury.json
This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Replit, StackBlitz, CodeSandbox, and CodePen.