{
  "family": "startsurf",
  "sample_count": 6358,
  "category": "browser_hijacker",
  "description": "Adware:Win32/StartSurf is a highly aggressive browser hijacker that forcefully modifies endpoint web configurations to route traffic through revenue-generating affiliate networks.<br><br><b>What is StartSurf?</b><br>For general consumers, StartSurf is an infuriating nuisance that locks their homepage and default search engine to <code>startsurf.com</code> (or similar variants). For incident responders, it is a persistent configuration management failure that compromises data privacy. StartSurf acts as a Man-in-the-Browser, intercepting user search queries, injecting sponsored advertisements, and tracking browsing history to monetize the endpoint.<br><br><b>Infection Vectors & Threat Hunting</b><br>StartSurf is entirely distributed via bundleware. Users inadvertently install it when rapidly clicking through the setup menus of freeware applications. Once executed, it drops malicious extensions into Chrome, Edge, and Firefox. Crucially, it establishes deep persistence by modifying Windows shortcut files (<code>.lnk</code>) on the Desktop and Taskbar, appending the StartSurf URL as an argument so that the hijacker launches every time the user opens their browser. It also creates scheduled tasks to reinstall the extensions if removed.<br><br><b>Forensic Analysis & Impact</b><br>The impact is a severe degradation of the user experience and a total loss of search privacy. Threat hunters should investigate the <code>HKCU\\Software\\Policies\\Google\\Chrome</code> registry hives for forced extension policies. Auditing the target paths of browser shortcuts will immediately reveal the appended malicious URLs. Network logs will show all search traffic being funneled through StartSurf's tracking infrastructure.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1112",
    "T1189",
    "T1053.005",
    "T1547.009",
    "T1176"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1547.009",
      "name": "Boot or Logon Autostart Execution: Shortcut Modification",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Deploy specialized adware removal tools to hunt down and strip StartSurf's deep registry hooks and forced group policies.",
    "Manually inspect all web browser desktop and taskbar shortcuts, removing the appended StartSurf URL from the 'Target' field.",
    "Audit the Windows Task Scheduler and delete any watchdog tasks designed to reinstall the adware.",
    "Reset all web browsers to factory defaults to clear rogue extensions and restore legitimate search configurations."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's extension manager for removal; StartSurf uses Group Policy to gray out the 'Remove' button.",
    "Avoid entering sensitive credentials while the hijacker is active, as it has full visibility into web traffic."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}