{
  "family": "yobrowser",
  "sample_count": 90,
  "category": "advanced_threat",
  "description": "Adware:Win32/Yobrowser is a deceptive Potentially Unwanted Program (PUP) that masquerades as a legitimate web browser but functions primarily as a framework for injecting advertisements, hijacking search queries, and aggressively harvesting user telemetry.<br><br><b>What is Yobrowser?</b><br>To the average user, Yobrowser often appears on their desktop after downloading freeware. It mimics the interface of Google Chrome (as it is typically built on the Chromium open-source project) but is pre-configured with malicious extensions and hijacked default settings. For security analysts, Yobrowser represents a severe privacy risk. Because it controls the rendering engine itself, it does not need to inject code into other browsers; it natively intercepts all traffic, SSL/TLS encryption notwithstanding, to harvest search terms, browsing history, and potentially sensitive form data for affiliate monetization.<br><br><b>Infection Vectors & Threat Hunting</b><br>Yobrowser is primarily distributed via Pay-Per-Install (PPI) software bundlers. During the installation of an unrelated program, Yobrowser is installed silently or through deceptive 'Accept' buttons. It establishes persistence by modifying Windows Registry Run keys and frequently alters file associations (making itself the default handler for HTML files and HTTP/HTTPS protocols) so that all web links open in Yobrowser instead of the user's preferred browser. It constantly communicates with its C2 infrastructure to download updated lists of ads to inject and to exfiltrate browsing telemetry.<br><br><b>Forensic Analysis & Impact</b><br>The primary impact is a total loss of browsing privacy and potential exposure of corporate data if used to access internal portals. Incident responders will observe a spike in outbound HTTP/HTTPS connections to known ad-tracking networks originating from the `yobrowser.exe` process. EDR logs will highlight the forced registry modifications targeting default browser settings (e.g., `HKCU\\Software\\Classes\\http\\shell\\open\\command`).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1112",
    "T1562.001",
    "T1189",
    "T1105",
    "T1176"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the active exfiltration of browsing telemetry and the downloading of further adware modules.",
    "Audit the 'Add/Remove Programs' list and manually uninstall the Yobrowser application and any bundled software.",
    "Deploy an enterprise-grade adware removal tool (e.g., AdwCleaner) to locate and strip the deep registry hooks and restore file associations.",
    "Reset the default Windows file associations (Default Apps) to ensure `http`/`https` protocols are routed back to a sanctioned, secure browser."
  ],
  "what_to_avoid": [
    "Do not allow users to log into any corporate portals using Yobrowser, as it actively intercepts and records all entered data.",
    "Avoid ignoring the infection; adware tracking data is highly detailed and may expose corporate activities to third-party brokers."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}