{
  "family": "domaiq",
  "sample_count": 63,
  "category": "pua",
  "description": "Adware:Win32/Domaiq is a prominent advertising-supported software family classified as a Potentially Unwanted Application (PUA) or browser hijacker.<br><br><b>Overview for Users and Analysts</b><br>While everyday users might view Domaiq merely as an annoyance that changes their homepage and floods them with pop-ups, cybersecurity experts recognize it as a persistent threat that actively degrades the security posture of an endpoint. Domaiq exists to generate fraudulent advertising revenue (click fraud) by forcibly redirecting user traffic through affiliate networks.<br><br><b>Infection and Evasion Strategies</b><br>Domaiq relies heavily on deceptive software installers. During the installation of a desired freeware application, Domaiq is silently unpacked and installed. It immediately begins modifying browser configurations (hijacking the default search engine, home page, and new tab page) and installing malicious BHOs (Browser Helper Objects). To maintain its presence against user removal attempts, Domaiq often employs defense evasion tactics: it may dynamically generate randomized filenames for its core executables and create hidden Windows Services that monitor and restore its components if they are deleted.<br><br><b>Forensic Footprint</b><br>Incident responders tracking Domaiq will frequently observe unauthorized modifications to browser shortcut files (<code>.lnk</code> files) and anomalous outbound HTTP traffic directed towards known advertising and tracking domains. EDR solutions typically flag its aggressive injection into browser processes and its unauthorized modifications to <code>HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\Main</code>.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1546.015",
    "T1189",
    "T1543.003",
    "T1562.001",
    "T1112"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1546.015",
      "name": "Event Triggered Execution: Component Object Model Hijacking",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Deploy enterprise EDR solutions or specialized anti-adware utilities to cleanly terminate Domaiq's hidden monitoring services.",
    "Audit all browser shortcut files (`.lnk`) on the desktop and taskbar, removing any malicious URLs appended to the target paths.",
    "Purge the system registry of Domaiq's persistence keys, specifically checking for rogue Browser Helper Objects (BHOs).",
    "Clear all browser caches, cookies, and extension directories to ensure no residual tracking scripts remain active."
  ],
  "what_to_avoid": [
    "Do not click on any pop-ups or warnings generated by Domaiq, as these often lead to the installation of secondary, more severe malware.",
    "Avoid manual registry editing unless conducted by an expert, as Domaiq often obfuscates its keys among critical Windows system entries."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}