{
  "family": "bhoint",
  "sample_count": 1,
  "category": "advanced_threat",
  "description": "<h3>Executive Summary</h3>\nBhoint is a classification for a specific type of persistent Adware and Browser Hijacker that operates primarily by installing malicious Browser Helper Objects (BHOs) into Internet Explorer (and historically other browsers supporting COM-based plugins). Its objective is to aggressively inject advertisements, monitor user browsing habits, and redirect traffic to affiliate-monetized websites.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nBhoint is almost exclusively distributed via deceptive software bundling. Users typically encounter it when downloading freeware from third-party aggregators, where the BHO is registered silently with the Windows OS during the primary software's setup.\n\nUpon execution, Bhoint establishes deep integration with the system's web rendering engine:\n<ul>\n<li><strong>BHO Registration and Hijacking:</strong> The software registers a COM object as a BHO in the Windows Registry (`HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects`). This ensures the malicious code is loaded every time the browser starts, effectively hijacking the browser's functionality.</li>\n<li><strong>DOM Manipulation and Ad Injection:</strong> Bhoint intercepts the rendering of legitimate websites, injecting its own HTML/JavaScript to overlay pages with pop-up ads, sliding banners, and in-text hyperlinks. It replaces legitimate ads to steal revenue.</li>\n<li><strong>Telemetry and Privacy Violation:</strong> The BHO continuously tracks the user's browsing history and search queries, transmitting this telemetry to remote servers for targeted advertising and profile building.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Bhoint is typically not designed for data destruction, it poses a severe threat to system stability, user productivity, and privacy. The constant ad injection consumes significant system resources, and BHOs run with the same privileges as the browser, making them a significant security risk if the adware infrastructure is compromised by more severe actors.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>BHO Unregistration:</strong> Standard antivirus often struggles with BHOs. Utilize a reputable enterprise anti-malware solution or tools like Sysinternals Autoruns to identify and unregister the specific malicious COM objects associated with Bhoint.</li>\n<li><strong>Registry Cleanup:</strong> Manually (or via script) remove the associated registry keys under the `Browser Helper Objects` hive to ensure the DLLs are not re-loaded.</li>\n<li><strong>Browser Factory Reset:</strong> Following the removal of the underlying files and registry keys, a full factory reset of the affected web browsers is required to purge any modified search preferences or homepages.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Adware.Bhoint",
    "PUP.Bhoint",
    "Win32/Adware.BHO"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1185",
    "T1176",
    "T1546.015"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T06:48:21Z",
  "type": "Adware / Browser Hijacker",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}