Progressive

Overview

Adware:Win32/Progressive (often associated with 'Progressive Web Apps' abuse or deceptive adware branding) is a classification for unwanted software that aggressively monitors user browsing habits to serve highly targeted, intrusive advertisements. It leverages both local system persistence and browser manipulation to generate fraudulent ad revenue or drive traffic to affiliate marketing sites (`T1189`).

Understanding Progressive (Adware)
To an end-user, Progressive severely disrupts the browsing experience. Users will encounter frequent pop-up ads, unexpected redirects when clicking legitimate links, and an overall slowing down of browser performance as the adware injects heavy JavaScript into every page visited. For a security team, it represents a data privacy issue and a potential gateway for malvertising attacks.

Execution and Persistence Mechanics
Progressive is commonly bundled with freeware, torrent downloads, or disguised as a necessary browser plugin. Once installed, it frequently establishes persistence by creating a Scheduled Task (`T1053.005`) that ensures the adware's core executable runs every time the user logs in. It then hooks into the browser processes or acts as a local proxy (`T1112`), intercepting all HTTP/HTTPS traffic. This allows it to inject its own advertising HTML/JavaScript directly into the Document Object Model (DOM) of the websites the user visits, bypassing many standard adblockers.

Indicators of Compromise & Impact
The primary impact is the loss of browsing privacy and exposure to potentially malicious third-party content. Host-based IoCs include the presence of unexpected scheduled tasks, unauthorized modifications to browser proxy settings, and the presence of unknown executables in `%ProgramFiles%` or `%LocalAppData%`. Network IoCs include a constant stream of background HTTP/HTTPS requests to known advertising networks, data brokers, and affiliate tracking domains.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_PROGRESSIVE {
    meta:
        description = "Detects Progressive (advanced_threat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "progressive" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Progressive Activity
id: 8cdb54955a2f9e45fea720cf3f666d93
status: experimental
description: Detects generic indicators of the progressive malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*progressive*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Use the Windows 'Programs and Features' control panel to uninstall the offending software and any recently installed 'free' applications.
2. Run a comprehensive scan with a reputable Adware/PUP removal tool to catch any persistent registry keys or scheduled tasks left behind.
3. Reset all web browsers (Chrome, Edge, Firefox) to their factory defaults to eliminate injected extensions and hijacked settings.
4. Verify that the system's local proxy settings (`inetcpl.cpl` -> Connections -> LAN settings) have not been maliciously altered.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not ignore the adware; the advertising networks it uses are often poorly vetted and can serve drive-by exploit kits.
2. Avoid clicking 'Next' rapidly during software installations without reading the EULA or unchecking 'Optional Offers'.

References & External Analysis

• Search "progressive" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: advanced_threat)

Explore other malware families in the same category:

• Yobrowser
• Mypcbackup
• Onescan
• Webaltatoolbar
• Oxypumper

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/progressive.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.