{
  "family": "forcestartpage",
  "sample_count": 5,
  "category": "advanced_threat",
  "description": "BrowserModifier:Win32/Forcestartpage is a generic classification for aggressive Potentially Unwanted Programs (PUAs) functioning as **Browser Hijackers**. Its primary objective is to silently modify the settings of installed web browsers (Chrome, Firefox, Edge) without user consent, forcibly changing the default homepage, new tab page, and default search engine to point to monetized, affiliate-controlled domains or adware networks.<br><br><b>Understanding Browser Hijackers</b><br>To an end-user, Forcestartpage manifests as severe frustration: every time they open their browser or search for something, they are redirected to an unfamiliar, ad-heavy search portal (like Yahoo Search provided by a shady third party, or a completely fake search engine). For an enterprise, it represents a security risk because the hijacked search results are completely unvetted and often prioritize links to tech support scams or malware exploit kits. It also allows for the unauthorized tracking of all user search queries.<br><br><b>Execution and Hijacking Mechanics</b><br>Forcestartpage is almost exclusively distributed via deceptive software bundling (`T1189`), secretly attached to the installers of legitimate freeware downloaded from untrusted sources. During installation (`T1204.002`), it installs itself as a malicious browser extension or modifies the browser's shortcut properties directly (appending a URL to the target path) (`T1547`). It forcibly modifies the browser's preferences (`T1562.001`) to point to its own monetization portals. To maintain persistence, it often employs a background Windows service or Scheduled Task that constantly monitors the browser settings, immediately reverting them back to the hijacked state if the user attempts to manually fix them.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is privacy violation (search tracking) and severe disruption of the user's workflow. IoCs include EDR alerts for unknown processes modifying browser preference files (e.g., Chrome's `Preferences` JSON file) or altering the properties of `.lnk` shortcut files on the Desktop. The user will report being unable to change their homepage back to Google or Bing. Network logs will show all search queries being routed through unknown tracking domains before reaching a search engine.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1189",
    "T1176",
    "T1562.001",
    "T1547.009"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Hijacking search/homepage settings)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Software bundling)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1547.009",
      "name": "Boot or Logon Autostart Execution: Shortcut Modification (Appending URLs to browser shortcuts)",
      "tactic": "Persistence"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions (Installing malicious extensions)",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Use the Windows Control Panel to uninstall the adware application and any other unknown software installed on the same date.",
    "Run a specialized enterprise adware removal tool (such as Malwarebytes) to eradicate the background services enforcing the persistence.",
    "Inspect all browser shortcut icons (on the Desktop and Taskbar) and remove any malicious URLs appended to the 'Target' field.",
    "Force a complete reset of all installed web browsers (Chrome, Edge, Firefox) to their factory defaults to clear hijacked settings and hidden extensions."
  ],
  "what_to_avoid": [
    "Avoid relying solely on removing the browser extension via the browser's UI, as the persistent updater process will simply reinstall it on the next reboot.",
    "Do not ignore the risk; hijacked search results are a primary vector for tricking users into downloading more severe malware."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}