{
  "family": "casinoonline",
  "sample_count": 12,
  "category": "advanced_threat",
  "description": "Adware:Win32/Casinoonline is a specialized Adware and Scareware family designed to aggressively promote online gambling sites and dubious online casinos. It infiltrates endpoints, typically via drive-by downloads or freeware bundling, and utilizes highly intrusive tactics to force the user to visit affiliate gambling portals.<br><br><b>What is Casinoonline?</b><br>To the average user, a Casinoonline infection is incredibly disruptive. The malware periodically forces the default web browser to open and navigate directly to various online casino websites, often generating pop-up windows that are difficult to close. For security analysts, Casinoonline is a classic Pay-Per-Install (PPI) or affiliate marketing scheme. The operators are paid a commission for every user they drive to the gambling portals. It utilizes aggressive persistence mechanisms to ensure the user cannot stop the forced redirects.<br><br><b>Infection Vectors & Threat Hunting</b><br>Casinoonline is distributed via deceptive software bundlers (`T1189`) or by exploiting vulnerabilities on streaming or torrenting sites. Upon execution, it does not just install browser extensions; it frequently establishes persistence by creating Scheduled Tasks (`T1053.005`) that are configured to launch the default browser pointing to a specific URL at regular intervals (e.g., every 30 minutes). It may also modify the Registry Run keys (`T1547.001`) and alter the shortcut icons for legitimate browsers (`T1546`), appending the gambling URL to the target path so that opening Chrome naturally launches the casino site.<br><br><b>Forensic Analysis & Impact</b><br>The primary impact is a severely degraded user experience and massive loss of productivity. Incident responders will observe anomalous DNS requests and HTTP/HTTPS traffic to known gambling and affiliate redirection networks. EDR logs will flag the modification of browser `.lnk` shortcut files and the creation of Scheduled Tasks launching `chrome.exe` or `msedge.exe` with specific URL arguments.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1112",
    "T1491",
    "T1546",
    "T1053.005",
    "T1189"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1546",
      "name": "Event Triggered Execution (Shortcut Modification)",
      "tactic": "Persistence"
    },
    {
      "id": "T1491",
      "name": "Defacement (UI Manipulation/Pop-ups)",
      "tactic": "Impact"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the active redirection and potential downloading of further adware modules.",
    "Audit Windows Scheduled Tasks and Registry Run keys to identify and remove the persistence mechanisms launching the browser.",
    "Inspect the properties of all web browser shortcut icons (on the Desktop, Taskbar, and Start Menu) and remove any malicious URLs appended to the 'Target' path.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to locate and strip any deeply embedded registry hooks."
  ],
  "what_to_avoid": [
    "Do not rely solely on resetting the browser homepage; the malware uses Scheduled Tasks and shortcut modifications to bypass browser-level settings.",
    "Avoid ignoring the infection; adware of this aggressive nature often provides a foothold for more severe malvertising attacks."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}