{
  "family": "conduit",
  "sample_count": 3,
  "category": "adware",
  "description": "Adware:Win32/Conduit is the detection name for one of the most infamous and widespread **Browser Hijackers** in the history of the internet. Distributed by the company Conduit Ltd. (later Perion), it primarily manifested as the 'Conduit Search' toolbar. While technically legal at the time, its extremely aggressive distribution methods, difficulty of removal, and invasive data collection led the cybersecurity industry to universally classify it as a Potentially Unwanted Program (PUP) and Adware.<br><br><b>Understanding Conduit (The Toolbar Epidemic)</b><br>To an end-user, Conduit was a massive source of frustration. It forcibly changed the browser's default homepage, new tab page, and search engine to `search.conduit.com`, injecting sponsored links and advertisements into all web results. For a security team, Conduit represented a severe compromise of endpoint hygiene and a vector for data leakage, as it tracked vast amounts of user browsing behavior (`T1562.001`).<br><br><b>Execution and Hijacking Mechanics</b><br>Conduit was almost always distributed via Pay-Per-Install (PPI) software bundles (`T1189`). When a user installed freeware (like a PDF reader or media player), the installer silently dropped the Conduit payload. It established deep persistence by registering as a Browser Helper Object (BHO) in Internet Explorer, an extension in Chrome/Firefox (`T1176`), and heavily modifying the Windows Registry (`T1112`) to ensure its search engine could not be easily reverted by the user. If a user tried to manually change their homepage back to Google, Conduit's background service would simply rewrite the registry key on the next reboot.<br><br><b>Indicators of Compromise & Impact</b><br>The impact was a severely degraded user experience and significant privacy violations. Host-based IoCs include the presence of Conduit/Perion folders in `Program Files`, registry keys containing 'Conduit', and the presence of associated BHOs. Network IoCs include all search traffic being forcibly routed through `search.conduit.com` or its affiliate networks.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1189",
    "T1562.001",
    "T1176",
    "T1112"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1176",
      "name": "Browser Extensions (Installing BHOs and Toolbars)",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry (Forcing homepage and search engine changes)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Browser Hijacking)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Bundled installations)",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Use the Windows Control Panel to thoroughly uninstall any programs published by 'Conduit', 'Perion', 'ClientConnect', or 'Spigot'.",
    "Manually remove any remaining 'Conduit Search' or 'Search Protect' extensions from all installed web browsers.",
    "Reset all web browsers (Chrome, Edge, Firefox, IE) to their absolute default settings to clear out hijacked homepages and search engines.",
    "Run a deep scan with an enterprise-grade Adware removal tool (like AdwCleaner or Malwarebytes) to purge the deeply embedded registry persistence."
  ],
  "what_to_avoid": [
    "Do not attempt to just change the homepage manually; the Conduit background services will instantly revert the changes.",
    "Avoid allowing users to download software from unverified third-party download portals, which was the primary vector for Conduit."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}