{
  "family": "opencandy",
  "sample_count": 110,
  "category": "adware",
  "description": "Adware:Win32/OpenCandy is an infamous, highly pervasive, and historically massive adware framework designed to be embedded directly into legitimate software installers to facilitate the distribution of third-party bundleware and PUPs.<br><br><b>Understanding OpenCandy</b><br>For the average user, OpenCandy was responsible for the sudden appearance of unwanted toolbars, search hijackers, and desktop icons after installing a seemingly safe, popular freeware application (like DAEMON Tools or PDFCreator). For security analysts, OpenCandy was the pioneer of the aggressive Pay-Per-Install (PPI) monetization model. It was not a standalone virus; it was a proprietary library (DLL) provided to developers to integrate into their installation wizards.<br><br><b>Execution and Evasion Strategies</b><br>When a user launched a legitimate software installer bundled with OpenCandy, the OpenCandy DLL executed in the background. It silently reached out to its C2 servers (e.g., <code>api.opencandy.com</code>) to retrieve a targeted list of adware based on the user's geolocation and operating system. The installer wizard would then dynamically generate deceptive screens (using pre-checked boxes or confusing wording) attempting to trick the user into 'Accepting' the third-party software. While technically requiring user consent, the tactics were highly deceptive.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is endpoint bloat, degraded performance, and significant privacy risks due to the aggressive tracking capabilities of the installed toolbars. Incident responders investigating an OpenCandy alert will typically find the alert triggered by the initial freeware installer file in the user's Downloads folder. EDR logs will show the installer reaching out to known OpenCandy affiliate networks.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1105",
    "T1112",
    "T1189",
    "T1204.002",
    "T1176"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Audit the 'Add/Remove Programs' list and uninstall the initial freeware application that triggered the alert, as well as any software installed concurrently.",
    "Deploy a reputable enterprise adware removal tool (like AdwCleaner) to locate and strip any installed toolbars, hidden services, or registry hooks.",
    "Reset all web browsers to their factory defaults to completely purge the rogue extensions and restore legitimate search settings.",
    "Educate users on the dangers of blindly clicking 'Next' during software installations and enforce strict application whitelisting."
  ],
  "what_to_avoid": [
    "Do not assume the endpoint is clean simply because the AV quarantined the initial installer; the user may have already run it.",
    "Avoid ignoring the infection; the affiliate networks OpenCandy contacted were known to distribute more severe threats alongside standard adware."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}