{
  "family": "mobogenie",
  "sample_count": 3,
  "category": "advanced_threat",
  "description": "Adware:Win32/Mobogenie is a highly intrusive Potentially Unwanted Program (PUP) that masquerades as a legitimate desktop management application for Android smartphones. While it technically provides basic file transfer capabilities, its primary function is aggressive monetization through bundled adware, browser hijacking, and, critically, pushing unwanted, potentially malicious APKs (Android applications) to devices connected to the infected PC.<br><br><b>Understanding Mobogenie (Cross-Platform Threat Vector)</b><br>To a Windows end-user, Mobogenie manifests as annoying pop-ups and a hijacked browser homepage. However, the true threat lies in its interaction with mobile devices. When a user connects their Android phone via USB, Mobogenie uses the ADB (Android Debug Bridge) connection to silently install unwanted applications directly onto the smartphone. For a security team, Mobogenie represents a unique threat vector that bridges the gap between a compromised workstation and a corporate mobile device.<br><br><b>Execution and Monetization Mechanics</b><br>Mobogenie is heavily distributed via software bundlers (Pay-Per-Install networks) (`T1189`). When executed on Windows (`T1204.002`), it establishes deep persistence (`T1547.001`) and heavily modifies browser settings (`T1112`) to inject ads. Furthermore, it operates as a background service constantly scanning for connected USB devices. If an Android device with 'USB Debugging' enabled is connected, Mobogenie acts as a rogue app store, silently pushing APKs (which generate affiliate revenue for the Mobogenie creators) to the phone, bypassing the Google Play Store entirely.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is dual-pronged: severe adware symptoms on the Windows host and unauthorized application installations on connected mobile devices. Host-based IoCs include the presence of `Mobogenie.exe`, EDR alerts for aggressive modifications to browser shortcut properties, and the installation of associated toolbars. A critical IoC is the presence of unexpected applications appearing on Android devices immediately after connecting them to the corporate network.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1112",
    "T1562.001",
    "T1547.001",
    "T1189"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Bundled installations)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Browser Hijacking)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1112",
      "name": "Modify Registry (Changing default search providers)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Use the Windows Control Panel to thoroughly uninstall the 'Mobogenie' application and any toolbars installed on the same date.",
    "Reset all installed web browsers on the Windows host to their default settings to clear out hijacked homepages and search engines.",
    "Run a comprehensive anti-malware scan to ensure no deeply embedded secondary payloads remain on the Windows host.",
    "Crucially, audit any Android devices that were connected to the infected machine and manually remove any unverified or unexpected applications."
  ],
  "what_to_avoid": [
    "Do not allow users to enable 'USB Debugging' on corporate Android devices unless strictly necessary for development, as this enables threats like Mobogenie.",
    "Avoid dismissing Mobogenie as just 'annoying adware'; its ability to push payloads to mobile devices makes it a significant security risk."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}