{
  "family": "ezsearch",
  "sample_count": 1,
  "category": "advanced_threat",
  "description": "<h3>Executive Summary</h3>\nEZSearch is a prevalent browser hijacker and adware program designed to forcibly redirect user search queries to a custom search portal. By hijacking the browser's default search engine and homepage, EZSearch generates illicit advertising revenue and exposes users to potentially malicious web content.\n\n<h3>Behavioral Analysis</h3>\nUnlike sophisticated malware, EZSearch operates primarily within the context of the user's web browser. It is typically distributed via software bundling, where it is silently installed alongside legitimate free applications. \n\nOnce installed, EZSearch immediately alters critical browser preferences across Google Chrome, Mozilla Firefox, and Microsoft Edge. It replaces the default search engine, modifies the homepage, and alters the new tab page to point to the EZSearch portal. The modified search portal often displays manipulated search results heavily biased toward sponsored links, affiliate programs, and low-reputation websites. Furthermore, the hijacker employs persistence mechanisms, such as modifying browser shortcut properties and utilizing malicious extensions, to prevent users from reverting the changes.\n\n<h3>Security and Privacy Risks</h3>\nWhile EZSearch does not typically destroy data, its privacy implications are significant. The hijacker tracks user search terms, browsing history, and click patterns, feeding this telemetry back to its operators. The manipulated search results also dramatically increase the likelihood of users inadvertently downloading actual malware or falling victim to phishing schemes.\n\n<h3>Removal and Prevention</h3>\n<ul>\n<li><strong>Browser Reset:</strong> The most effective immediate remediation is to completely reset the affected browser to its default settings, which clears unauthorized extensions and modified preferences.</li>\n<li><strong>Shortcut Verification:</strong> Inspect browser shortcuts (e.g., on the Desktop or Taskbar) and remove any appended arguments in the 'Target' field that force the browser to open the EZSearch URL.</li>\n<li><strong>User Education:</strong> Train users to carefully review installation prompts when downloading freeware and to always opt for 'Custom' or 'Advanced' installation options to uncheck bundled software.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Hijacker.EZSearch",
    "Adware.EZSearch",
    "BrowserModifier:Win32/EZSearch"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1176",
    "T1562.001",
    "T1112"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T16:00:59Z",
  "type": "Browser Hijacker",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}