{
  "family": "outbrowse",
  "sample_count": 34,
  "category": "pua",
  "description": "PUA:Win32/Outbrowse is a highly prevalent, aggressive software bundler and adware framework. While operating in a legal gray area as an 'installer wrapper', it functions identically to adware droppers by utilizing dark patterns to trick users into installing multiple, unwanted third-party applications (browser hijackers, fake optimizers) alongside their intended software.<br><br><b>Understanding Outbrowse</b><br>To the end-user, Outbrowse presents itself as a standard installation wizard for downloaded freeware. However, for a security analyst, this wrapper is a Monetization Engine (PPI). The wrapper executes first, presenting a series of installation screens where 'accepting' the terms of service actually consents to installing hidden adware. The core objective of Outbrowse is to maximize the number of affiliate payloads installed per execution.<br><br><b>Execution and Evasion Strategies</b><br>The Outbrowse bundler utilizes 'Dark Patterns' (`T1189`). Pre-checked boxes are hidden behind 'Advanced Installation' tabs, and the 'Decline' buttons are often grayed out, misleadingly placed, or worded in a confusing double-negative. If the user clicks 'Next' too quickly, the wrapper reaches out to its affiliate command server, pulls down the secondary adware payloads, and installs them silently in the background (`T1105`). These payloads often include browser extensions (`T1176`) that forcibly alter the default search engine to generate affiliate click revenue.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is widespread system pollution, significant performance degradation, and compromised browsing privacy. EDR tools will flag the execution of the initial Outbrowse wrapper attempting to drop secondary executables into `%Temp%` or `%AppData%`. Incident responders will observe a sudden spike in installed programs (visible in 'Add/Remove Programs') all sharing the exact same installation timestamp.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1112",
    "T1105",
    "T1176",
    "T1189",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the active downloading of further adware or PUA payloads.",
    "Review the Windows 'Add/Remove Programs' interface (Appwiz.cpl) and manually uninstall all unrecognized software installed concurrently with the Outbrowse wrapper.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner or Malwarebytes) to locate and strip the registry hooks and BHOs left behind.",
    "Block access to known affiliate download networks at the corporate firewall or DNS level."
  ],
  "what_to_avoid": [
    "Do not allow users to download software from third-party aggregators; enforce policies that require downloading directly from the official vendor.",
    "Avoid relying solely on uninstalling the main application; the bundled PUAs install as independent programs and must be removed separately."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}