{
  "family": "browsefox",
  "sample_count": 73,
  "category": "adware",
  "description": "Adware:Win32/Browsefox is a highly aggressive and widespread software bundling framework (adware/PUA) designed to silently install unwanted third-party applications, browser hijackers, and telemetry trackers alongside legitimate freeware.<br><br><b>What is Browsefox?</b><br>To the average user, Browsefox is the reason their browser homepage suddenly changed and their computer slowed down after downloading a free PDF creator or media player. For security analysts, Browsefox operates on the Pay-Per-Install (PPI) model. It is not a standalone virus; it is an installation wrapper utilized by deceptive download portals. The creators of Browsefox are paid by affiliate networks for every successful installation of secondary adware modules they achieve on a victim's machine.<br><br><b>Infection Vectors & Threat Hunting</b><br>Browsefox is almost exclusively distributed via deceptive software download sites. When the user executes the installer, Browsefox profiles the endpoint (checking the OS version, geolocation, and installed security software) and reaches out to a Command-and-Control (C2) server. It then downloads a tailored payload of adware. It employs deceptive UI patterns during installation ('Dark Patterns')—such as pre-checked boxes hidden behind 'Advanced' menus—to gain technical 'consent' while practically ensuring the user installs the junkware. Persistence is typically achieved via Registry Run keys and scheduled tasks that reinstall browser extensions if the user removes them.<br><br><b>Forensic Analysis & Impact</b><br>The primary impact is a severely bloated endpoint, compromised browsing privacy, and wasted helpdesk resources. Incident responders will observe the initial installer file in the user's Downloads directory attempting to spawn multiple child processes (like `msiexec.exe` or `cmd.exe`) to silently install the secondary payloads. Network logs will show a flurry of HTTP connections to known affiliate tracking domains and ad networks.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1562.001",
    "T1204.002",
    "T1105",
    "T1176",
    "T1189"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Quarantine the initial installer executable to prevent further execution and secondary payload downloads.",
    "Audit the 'Add/Remove Programs' list and manually uninstall any unexpected applications that appeared concurrently with the Browsefox detection.",
    "Deploy an enterprise-grade adware removal tool (e.g., AdwCleaner) to locate and strip deep registry hooks, scheduled tasks, and forced browser policies.",
    "Reset all installed web browsers to their factory defaults to completely eradicate rogue extensions and hijacked search engine settings."
  ],
  "what_to_avoid": [
    "Do not assume the endpoint is clean simply because the AV quarantined the initial installer; the user may have already completed the installation.",
    "Avoid ignoring the infection; the tracking infrastructure actively harvests browsing habits, and the PPI network may pivot to delivering more severe threats."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}