{
  "family": "crossrider",
  "sample_count": 39,
  "category": "adware",
  "description": "Adware:Win32/Crossrider is a highly prevalent, sophisticated framework originally designed as a legitimate cross-browser extension development tool. However, it was massively co-opted and abused by cybercriminals and adware affiliates to deploy aggressive browser hijackers, inject unwanted advertisements, and harvest extensive user browsing telemetry.<br><br><b>Understanding Crossrider</b><br>To the end-user, a Crossrider infection manifests as a severely compromised browsing experience. Their default search engine is forcibly altered, homepages are locked to affiliate domains, and standard websites are injected with pop-ups and in-text ads. For a security analyst, Crossrider is a powerful monetization engine. Because it was originally a legitimate development framework, it possesses robust APIs that allow threat actors to easily write a single payload that instantly infects Chrome, Firefox, and Internet Explorer simultaneously.<br><br><b>Execution and Evasion Strategies</b><br>Crossrider is almost always distributed via deceptive software bundlers (`T1189`) (e.g., fake Flash Player updates or bundled with 'free' media converters). Upon execution, the installer utilizes the Crossrider API to drop malicious browser extensions (`T1176`). To maintain persistence and prevent the user from simply deleting the extension, it frequently modifies browser shortcut files (`.lnk`) to append malicious URLs to the target path (`T1546.015`). It also establishes scheduled tasks and creates local Windows services to act as 'watchdogs'; if the user removes the extension, the watchdog service instantly reinstalls it upon the next reboot.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a loss of browsing privacy, system instability, and high helpdesk ticket volume. EDR platforms will detect the unauthorized modification of browser preference files (`Preferences` in Chrome) and the creation of anomalous scheduled tasks. Network logs will reveal constant HTTP/HTTPS traffic to tracking domains (often fast-flux or dynamically generated). The presence of the `Crossrider` directory in `%ProgramFiles%` or `%AppData%` is a definitive IoC.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1562.001",
    "T1546.015",
    "T1176",
    "T1112",
    "T1189"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1546.015",
      "name": "Event Triggered Execution: Component Object Model Hijacking",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the exfiltration of tracking data and the downloading of further adware configurations.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to locate and strip the deeply embedded registry hooks, watchdogs, and BHOs.",
    "Manually inspect all desktop and taskbar shortcuts (.LNK files) for web browsers, removing any malicious URLs appended to the 'Target' path.",
    "Force a complete factory reset of all installed web browsers to clear local storage, caches, and rogue extension profiles."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's native 'remove extension' feature; Crossrider's background watchdog services will simply reinstall it.",
    "Avoid ignoring the infection; adware tracking data is highly granular and may expose sensitive corporate portals or internal naming conventions."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}