{
  "family": "addmepoint",
  "sample_count": 1,
  "category": "advanced_threat",
  "description": "Adware:Win32/Addmepoint is a specialized adware and social media hijacking tool designed to forcibly manipulate a user's web browser and social media accounts. Its primary goal is to fraudulently inflate 'Likes', 'Followers', or views on specific social media platforms (like Facebook, Twitter, or YouTube) by utilizing the infected victim's authenticated sessions without their consent (`T1189`).<br><br><b>Understanding Addmepoint (Social Hijacking)</b><br>To an end-user, Addmepoint might cause their browser to slow down, and they may notice their social media accounts suddenly following unknown people, joining random groups, or 'liking' bizarre posts. For an IT department, Addmepoint represents a significant privacy and credential theft risk, as the malware has direct access to the user's active session cookies.<br><br><b>Execution and Hijacking Mechanics</b><br>Addmepoint is typically distributed via deceptive software bundles (Pay-Per-Install networks). Upon execution, it installs a malicious browser extension (Chrome, Firefox, Edge) to establish persistence (`T1176`). Because the extension operates within the browser context, it inherently bypasses multi-factor authentication (MFA). It utilizes Cross-Site Scripting (XSS) techniques or directly interacts with the social media platform's API using the victim's stolen session cookies (`T1539`). It forces the browser to silently navigate to target pages and perform automated actions in the background.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the compromise of the user's digital identity and the unauthorized use of their accounts for click-fraud. Host-based IoCs include the presence of unwanted browser extensions (often hiding under generic names), unauthorized modifications to browser shortcut files (`.lnk`), and unexpected background processes. Network IoCs involve the browser making high-volume, automated HTTP requests to social media APIs that do not correlate with the user's active browsing behavior.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1176",
    "T1189",
    "T1539"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Distribution via bundled freeware installers)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions (Installing malicious add-ons to control the browser)",
      "tactic": "Persistence"
    },
    {
      "id": "T1539",
      "name": "Steal Web Session Cookie (Abusing active authenticated sessions to perform social media fraud)",
      "tactic": "Credential Access"
    }
  ],
  "containment_steps": [
    "Force a sign-out of all active social media and web sessions to invalidate the stolen cookies.",
    "Use a reputable anti-malware tool to locate and remove the Addmepoint executables and malicious browser extensions.",
    "Reset all web browsers to their default settings to remove any forced proxy configurations or persistent scripts.",
    "Advise the user to review their social media activity logs and revoke any 'Likes' or 'Follows' they did not authorize."
  ],
  "what_to_avoid": [
    "Do not assume that changing the account password will immediately stop the activity; you must invalidate the active session cookies.",
    "Avoid relying solely on the browser's extension manager to remove the threat, as Addmepoint often uses background services to reinstall the extension."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}