{
  "family": "cntads",
  "sample_count": 1,
  "category": "advanced_threat",
  "description": "<h3>Executive Summary</h3>\nCntads is a highly persistent adware family and Potentially Unwanted Program (PUP) engineered to hijack web traffic and bombard users with unsolicited advertising content. It is designed purely for financial gain, generating revenue for its operators through pay-per-click (PPC) and pay-per-view (PPV) affiliate schemes.\n\n<h3>Infection Vector and Operational Tactics</h3>\nCntads primarily utilizes software bundling as its distribution mechanism. It is frequently hidden within the custom installers of \"free\" software (like media converters or download managers) hosted on third-party aggregation sites.\n\nUpon installation, Cntads deeply embeds itself into the operating system and installed web browsers. Its core disruptive behaviors include:\n<ul>\n<li><strong>Aggressive Ad Injection:</strong> Cntads injects JavaScript into active browsing sessions, overlaying legitimate websites with intrusive pop-ups, pop-unders, and banner advertisements. It often highlights random words in text, turning them into sponsored hyperlinks.</li>\n<li><strong>Browser Hijacking:</strong> The adware frequently alters the default search engine and homepage to direct all user queries through a custom, affiliate-linked search portal.</li>\n<li><strong>Persistence Mechanisms:</strong> Cntads is notoriously difficult to remove manually. It utilizes hidden scheduled tasks, malicious browser extensions, and registry run keys to automatically reinstall itself if basic removal attempts are made.</li>\n</ul>\n\n<h3>Privacy and Security Implications</h3>\nWhile Cntads is focused on advertising, it poses a severe threat to user privacy. The adware continuously tracks search queries, browsing history, and IP data to serve targeted ads. Furthermore, the aggressive nature of the injected ads frequently exposes users to \"malvertising,\" increasing the risk of secondary infections from exploit kits or tech support scams.\n\n<h3>Mitigation and Removal</h3>\n<ul>\n<li><strong>Comprehensive EPP Scanning:</strong> Utilize enterprise-grade anti-malware solutions to detect and quarantine the core Cntads executables and associated dynamic link libraries (DLLs).</li>\n<li><strong>Browser Reset and Extension Removal:</strong> Manually delete all suspicious browser extensions and perform a full reset of the affected web browsers to clear hijacked search and homepage settings.</li>\n<li><strong>Task Scheduler Audit:</strong> Open the Windows Task Scheduler (`taskschd.msc`) and manually delete any anomalous tasks created by Cntads to ensure persistence is broken.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Adware.Cntads",
    "PUP.Cntads",
    "Cntads Adware"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1566.002",
    "T1176",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T16:09:08Z",
  "type": "Adware",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}