{
  "family": "progressive",
  "sample_count": 2,
  "category": "advanced_threat",
  "description": "Adware:Win32/Progressive (often associated with 'Progressive Web Apps' abuse or deceptive adware branding) is a classification for unwanted software that aggressively monitors user browsing habits to serve highly targeted, intrusive advertisements. It leverages both local system persistence and browser manipulation to generate fraudulent ad revenue or drive traffic to affiliate marketing sites (`T1189`).<br><br><b>Understanding Progressive (Adware)</b><br>To an end-user, Progressive severely disrupts the browsing experience. Users will encounter frequent pop-up ads, unexpected redirects when clicking legitimate links, and an overall slowing down of browser performance as the adware injects heavy JavaScript into every page visited. For a security team, it represents a data privacy issue and a potential gateway for malvertising attacks.<br><br><b>Execution and Persistence Mechanics</b><br>Progressive is commonly bundled with freeware, torrent downloads, or disguised as a necessary browser plugin. Once installed, it frequently establishes persistence by creating a Scheduled Task (`T1053.005`) that ensures the adware's core executable runs every time the user logs in. It then hooks into the browser processes or acts as a local proxy (`T1112`), intercepting all HTTP/HTTPS traffic. This allows it to inject its own advertising HTML/JavaScript directly into the Document Object Model (DOM) of the websites the user visits, bypassing many standard adblockers.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the loss of browsing privacy and exposure to potentially malicious third-party content. Host-based IoCs include the presence of unexpected scheduled tasks, unauthorized modifications to browser proxy settings, and the presence of unknown executables in `%ProgramFiles%` or `%LocalAppData%`. Network IoCs include a constant stream of background HTTP/HTTPS requests to known advertising networks, data brokers, and affiliate tracking domains.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1112",
    "T1053.005",
    "T1189"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Distribution via deceptive software bundles)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task (Establishing persistent adware updaters)",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry (Modifying proxy settings to intercept and inject ads into web traffic)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Use the Windows 'Programs and Features' control panel to uninstall the offending software and any recently installed 'free' applications.",
    "Run a comprehensive scan with a reputable Adware/PUP removal tool to catch any persistent registry keys or scheduled tasks left behind.",
    "Reset all web browsers (Chrome, Edge, Firefox) to their factory defaults to eliminate injected extensions and hijacked settings.",
    "Verify that the system's local proxy settings (`inetcpl.cpl` -> Connections -> LAN settings) have not been maliciously altered."
  ],
  "what_to_avoid": [
    "Do not ignore the adware; the advertising networks it uses are often poorly vetted and can serve drive-by exploit kits.",
    "Avoid clicking 'Next' rapidly during software installations without reading the EULA or unchecking 'Optional Offers'."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}