{
  "family": "wajam",
  "sample_count": 131,
  "category": "adware",
  "description": "Adware:Win32/Wajam (often detected as SearchProtect or Wajam Internet Enhancer) is a highly prevalent browser hijacker and Potentially Unwanted Program (PUP).<br><br><b>What is Wajam?</b><br>For laymen, Wajam masquerades as a legitimate social search tool that injects your friends' recommendations into search results. However, for cybersecurity experts and incident responders, Wajam is classified as an aggressive adware variant that performs non-consensual modifications to system settings, intercepts web traffic, and tracks user behavior without clear consent.<br><br><b>Infection Vectors & Threat Hunting</b><br>Wajam typically infiltrates environments through software bundling—users download free utilities from third-party aggregators, inadvertently executing a dropper that installs Wajam silently in the background. Once active, it leverages rootkit-like techniques to protect its processes. It modifies Windows Registry run keys, alters browser shortcut arguments (appending tracking URLs), and installs rogue browser extensions. <br><br><b>Forensic Analysis & Impact</b><br>From a forensic perspective, Wajam acts as a Man-in-the-Middle (MitM) proxy, intercepting TLS/SSL traffic to inject sponsored advertisements and track search queries across Google, Bing, and Yahoo. This not only degrades system performance but poses a severe data privacy risk. Advanced Endpoint Detection and Response (EDR) platforms frequently flag its behavior due to its aggressive evasion techniques, such as disabling legitimate anti-virus software and utilizing scheduled tasks to reinstall itself if partially removed.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1189",
    "T1547.001",
    "T1562.001",
    "T1053.005",
    "T1556",
    "T1185"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1556",
      "name": "Modify Authentication Process",
      "tactic": "Credential Access"
    },
    {
      "id": "T1185",
      "name": "Browser Session Hijacking",
      "tactic": "Collection"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint to prevent the exfiltration of browsing history and potentially sensitive intercepted credentials.",
    "Utilize specialized adware removal tools (e.g., AdwCleaner, Malwarebytes) as traditional AV may struggle with Wajam's persistence mechanisms.",
    "Audit and remove unauthorized Man-in-the-Middle (MitM) root certificates installed by Wajam in the Windows Certificate Store.",
    "Reset all web browsers (Chrome, Edge, Firefox) to default settings and manually inspect desktop shortcuts for appended malicious arguments."
  ],
  "what_to_avoid": [
    "Do not trust the standard Windows 'Add/Remove Programs' interface to fully uninstall Wajam, as its uninstaller often leaves active scheduled tasks behind.",
    "Avoid entering sensitive information or credentials on an infected machine, as Wajam's traffic interception can capture plain-text inputs."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}