{
  "family": "bundlore",
  "sample_count": 16,
  "category": "advanced_threat",
  "description": "Adware:Win32/Bundlore (also highly prevalent on macOS as OSX/Bundlore) is a prolific and aggressive adware bundler framework. It specializes in using deceptive installation wrappers to silently deploy browser hijackers, unwanted toolbars, and tracking software alongside legitimate or pirated applications.<br><br><b>Understanding Bundlore</b><br>To an end-user, Bundlore is a massive annoyance. After downloading a 'free' utility (like a PDF converter or a flash player update), their web browser is hijacked: the homepage changes, search results are flooded with sponsored links, and pop-up ads appear constantly. For security analysts, Bundlore operates on a sophisticated Pay-Per-Install (PPI) model. The attackers monetize the initial infection by forcibly injecting affiliate advertisements into the user's web traffic and harvesting their browsing telemetry.<br><br><b>Execution and Deceptive Bundling</b><br>Bundlore relies entirely on social engineering and deceptive UI/UX ('Dark Patterns') during the installation phase (`T1189`). The primary installer executes and presents a standard End User License Agreement (EULA). However, hidden behind 'Advanced' or 'Custom' installation menus are pre-checked boxes authorizing the installation of multiple 'special offers' (the adware payloads). Once authorized, Bundlore drops and installs rogue browser extensions (`T1176`) and frequently modifies the shortcut files (`.lnk`) for Chrome, Firefox, and Edge to append malicious URLs to the target path (`T1546`). It establishes persistence using Scheduled Tasks (`T1053.005`) to monitor the browser and reinstall the adware if the user attempts to remove it.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a degraded user experience, loss of productivity, and severe privacy violations due to the constant exfiltration of search history. EDR platforms will flag the initial installer executing `wscript.exe` or PowerShell scripts to modify browser preferences and create unauthorized Scheduled Tasks. Network logs will reveal anomalous routing of standard HTTP traffic through affiliate marketing networks.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1053.005",
    "T1562.001",
    "T1176",
    "T1189",
    "T1546"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1546",
      "name": "Event Triggered Execution: Browser Shortcut Modification",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Use enterprise endpoint management tools to forcefully remove the rogue browser extensions and reset the default search providers.",
    "Audit the properties of all browser shortcuts (`.lnk` files) on the user's Desktop, Taskbar, and Start Menu to remove any appended malicious URLs.",
    "Use the Windows Control Panel to uninstall the bundled applications, followed by deploying an adware removal tool (e.g., AdwCleaner) to strip the remaining Scheduled Tasks and registry hooks.",
    "Force a complete reset of all installed web browsers to factory defaults."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's 'remove extension' button; Bundlore uses watchdog services (Scheduled Tasks) to immediately re-apply the malicious settings.",
    "Avoid ignoring the infection; the affiliate networks powering these hijackers often serve malicious advertisements (malvertising) that can lead to severe malware infections."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}