{
  "family": "spigot",
  "sample_count": 1008,
  "category": "adware",
  "description": "Adware:Win32/Spigot is a highly pervasive and legally controversial adware family that bundles unwanted toolbars, browser hijackers, and system optimizers with legitimate software.<br><br><b>Understanding Spigot</b><br>To the average consumer, Spigot manifests as unwanted search bars (like the Yahoo! powered 'Search Protection' toolbar), altered home pages, and persistent pop-up ads. For incident responders, Spigot is a persistent headache that dramatically increases the attack surface of the endpoint. While not traditionally malicious (like a trojan), its aggressive modification of browser settings and data harvesting practices make it a significant privacy risk.<br><br><b>Execution and Evasion Strategies</b><br>Spigot is the quintessential bundleware. It partners with freeware developers (e.g., PDF creators, video converters) to include the Spigot installer in the setup wizard. Users who rapidly click 'Next' during installation inadvertently agree to the installation. Once active, Spigot drops multiple extensions across Chrome, Edge, and Firefox. It alters the default search engine to route queries through affiliate networks to generate pay-per-click revenue. It protects these settings by installing a watchdog service that reverts any user-attempted changes back to the Spigot defaults.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters will easily identify Spigot by the presence of multiple unwanted extensions and toolbars. The Windows Registry will show heavy modifications under <code>HKCU\\Software\\Spigot</code> and altered browser start pages. Network traffic will show constant outbound telemetry to Spigot's tracking domains, sending search histories and browsing patterns back to the parent company.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1562.001",
    "T1053.005",
    "T1176",
    "T1189",
    "T1112"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Utilize specialized adware removal tools (e.g., AdwCleaner, Malwarebytes) to automatically identify and strip Spigot's deep registry hooks.",
    "Audit the Windows 'Add/Remove Programs' list and uninstall any suspicious toolbars, search protectors, or 'PC Optimizers'.",
    "Manually reset all web browsers to their factory defaults to purge the rogue extensions and restore the legitimate search engine.",
    "Delete any Spigot-related scheduled tasks in the Windows Task Scheduler to prevent automatic reinstallation."
  ],
  "what_to_avoid": [
    "Do not trust the Spigot uninstaller provided in the Control Panel; it frequently leaves tracking modules and scheduled tasks behind.",
    "Avoid ignoring adware infections; they drastically lower the endpoint's security posture and often download secondary PUAs."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}