{
  "family": "brosafe",
  "sample_count": 1,
  "category": "advanced_threat",
  "description": "<h3>Executive Summary</h3>\nBroSafe is a deceptive adware family and Potentially Unwanted Program (PUP) that masquerades as a legitimate security or system optimization tool. While claiming to enhance browsing safety, its true objective is to monetize the user's system through aggressive and intrusive advertising.\n\n<h3>Technical Characteristics</h3>\nBroSafe exploits the user's desire for improved cybersecurity by presenting itself as a \"safe browsing\" extension or system utility. It is commonly distributed through deceptive pop-up warnings on low-reputation websites or bundled with third-party software installers.\n\nOnce active, BroSafe fails to provide its advertised security benefits. Instead, it injects tracking cookies, monitors web traffic, and overlays excessive advertisements on legitimate websites. The adware frequently communicates with an array of affiliate networks, downloading new ad payloads and reporting on user interaction metrics. BroSafe is known for its aggressive persistence; it often creates scheduled tasks and registry run keys to ensure it restarts automatically, and it may actively resist uninstallation attempts by hiding its core components deep within the Windows AppData directory.\n\n<h3>Risk Assessment</h3>\nThe primary risk associated with BroSafe is the degradation of system performance and the severe compromise of user privacy. By acting as a man-in-the-browser, BroSafe can intercept sensitive information. Furthermore, the ads it serves are often poorly vetted, leading to secondary infections if a user interacts with malicious sponsored content.\n\n<h3>Mitigation Strategies</h3>\n<ul>\n<li><strong>Endpoint Protection:</strong> Utilize comprehensive EPP/EDR solutions configured to detect and block Potentially Unwanted Programs (PUPs) automatically.</li>\n<li><strong>Application Control:</strong> Restrict administrative privileges to prevent standard users from installing unverified software or browser extensions.</li>\n<li><strong>System Remediation:</strong> Remove BroSafe via the Windows Control Panel, delete associated scheduled tasks using `schtasks`, and clear all browser caches and cookies.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "PUP.BroSafe",
    "Adware.BroSafe",
    "BroSafe Adware"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1566.002",
    "T1036",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T16:00:59Z",
  "type": "Adware",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}