{
  "family": "linkury",
  "sample_count": 1194,
  "category": "adware",
  "description": "Adware:Win32/Linkury is a massive, highly organized adware and click-fraud network that aggressively monetizes infected endpoints through forced advertisements and traffic redirection.<br><br><b>Understanding Linkury</b><br>To the end-user, Linkury renders a computer nearly unusable by injecting in-text hyperlinks, pop-up ads, and fake security warnings into every visited webpage. For security analysts, Linkury represents a severe compromise of the browser's security boundary. It acts as a Man-in-the-Browser (MitB), utilizing local proxies and rogue root certificates to intercept and decrypt SSL/TLS traffic, allowing it to inject ads even on secure HTTPS sites.<br><br><b>Execution and Evasion Strategies</b><br>Linkury is distributed via pay-per-install (PPI) software bundlers. Once installed, it drops its Smartbar (or similar toolbars) and rogue extensions across all browsers. It establishes persistence by modifying the Windows Internet Options to route all traffic through a local proxy (usually <code>127.0.0.1</code>) controlled by the adware. It protects its components by installing a Windows Service that actively monitors the registry; if a user attempts to remove the proxy settings, the service instantly reverts them.<br><br><b>Indicators of Compromise (IoCs)</b><br>Incident responders should immediately audit the Windows Certificate Store for unauthorized, self-signed Root CAs, which Linkury uses to facilitate its HTTPS interception. Threat hunters will find anomalous proxy configurations in the registry (<code>HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings</code>). Network logs will reveal massive volumes of HTTP GET requests directed at known ad-tracking and affiliate networks.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1112",
    "T1189",
    "T1543.003",
    "T1185",
    "T1556"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1556",
      "name": "Modify Authentication Process",
      "tactic": "Credential Access"
    },
    {
      "id": "T1185",
      "name": "Browser Session Hijacking",
      "tactic": "Collection"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the exfiltration of intercepted web traffic and prevent further click-fraud.",
    "Open the Windows Certificate Manager (certmgr.msc) and forcefully delete any rogue Root Certificates installed by Linkury.",
    "Remove the unauthorized local proxy configuration from Windows Internet Options and flush the DNS cache.",
    "Audit the Windows Services (services.msc) to identify and disable the watchdog service protecting the adware."
  ],
  "what_to_avoid": [
    "Do not allow the user to log into secure corporate or financial portals while infected, as Linkury decrypts and inspects all SSL traffic.",
    "Avoid relying solely on Chrome's extension manager for removal; the local proxy and Windows Service must be neutralized first."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}