{
  "family": "extenbro",
  "sample_count": 204,
  "category": "browser_hijacker",
  "description": "BrowserModifier:Win32/Extenbro is an aggressive malware family designed to forcefully install rogue browser extensions, hijack search traffic, and actively block the user from accessing antivirus and security vendor websites.<br><br><b>What is Extenbro?</b><br>To the average user, Extenbro renders the browsing experience infuriating, replacing their default homepage and search engine with affiliate-branded portals and preventing them from downloading malware removal tools. For IT security teams, it represents a significant compliance and defense evasion risk. Extenbro acts as a persistent Man-in-the-Browser, intercepting all search queries to harvest marketing data and actively blinding the endpoint to remediation efforts.<br><br><b>Infection Vectors & Threat Hunting</b><br>Extenbro is primarily distributed via software bundling or drive-by downloads. Once executed, it drops malicious extensions across all installed browsers (Chrome, Firefox, Edge). To evade removal, Extenbro deeply embeds itself in the Windows Registry (<code>HKLM\\SOFTWARE\\Policies</code>) utilizing Group Policy to prevent the user from disabling the malicious extensions. Crucially, Extenbro modifies the Windows HOSTS file or intercepts DNS queries to sinkhole connections to domains associated with Microsoft, Malwarebytes, Symantec, and other security vendors.<br><br><b>Forensic Analysis & Impact</b><br>Threat hunters can easily identify Extenbro by inspecting the browser extension list and noting policies that 'Manage' the browser. The Windows Registry will contain numerous unauthorized modifications under the Policies hives. Network traffic will show all search queries being funneled through the Extenbro tracking infrastructure, while connections to AV vendors will time out. The impact is a severely degraded user experience, loss of privacy, and a defenseless endpoint.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1566",
    "T1112",
    "T1176",
    "T1189",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1566",
      "name": "Phishing",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Deploy specialized offline adware removal utilities (like AdwCleaner run from a USB drive) to locate and strip the forced Group Policies.",
    "Open the Windows HOSTS file (<code>C:\\Windows\\System32\\drivers\\etc\\hosts</code>) and delete the entries blocking access to security vendors.",
    "Reset all web browsers to their factory defaults to completely purge the rogue extensions and toolbars.",
    "Audit the Windows Registry (<code>HKCU\\Software\\Policies\\Google\\Chrome</code>) to manually delete the forced extension IDs."
  ],
  "what_to_avoid": [
    "Do not trust the browser's built-in extension manager for removal, as Extenbro uses Group Policy to gray out the 'Remove' option.",
    "Avoid assuming the endpoint is secure just because the homepage is fixed; the DNS hijacking preventing AV updates must be resolved."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}