{
  "family": "zamg",
  "sample_count": 527,
  "category": "trojan_generic",
  "description": "Adware:Win32/Zamg is a highly aggressive adware framework and Potentially Unwanted Application (PUA) known for deep browser hooking and relentless pop-up generation.<br><br><b>Understanding Zamg</b><br>To an everyday user, Zamg renders web browsing intolerable by injecting full-page advertisements, in-text hyperlinks, and fake software update warnings. For security teams, Zamg is a severe risk to endpoint hygiene. It acts as a Man-in-the-Browser (MitB), intercepting all HTTP and HTTPS traffic to monetize the user's browsing habits, which inherently exposes sensitive session tokens and passwords to third-party ad networks.<br><br><b>Execution and Evasion Strategies</b><br>Zamg is exclusively distributed via deceptive software bundlers. Users downloading freeware, PDF converters, or media players from untrusted repositories inadvertently install the Zamg framework. It establishes persistence by installing a local proxy server on the machine and modifying the Windows Registry to force all browsers (Chrome, Edge, Firefox) to route traffic through it. Furthermore, it installs rogue Root Certificates to decrypt and inspect SSL/TLS traffic, allowing it to inject ads even on secure banking or email sites.<br><br><b>Indicators of Compromise (IoCs)</b><br>Incident responders should audit the Windows Internet Options for unauthorized <code>127.0.0.1</code> proxy settings. Threat hunters will often find anomalous scheduled tasks designed to reinstall the Zamg browser extensions if they are manually removed. The presence of unauthorized certificates in the Trusted Root Certification Authorities store is the most critical IoC, as it indicates a total compromise of encrypted communications.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1053.005",
    "T1556",
    "T1176",
    "T1112",
    "T1185"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1185",
      "name": "Browser Session Hijacking",
      "tactic": "Collection"
    },
    {
      "id": "T1556",
      "name": "Modify Authentication Process",
      "tactic": "Credential Access"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the exfiltration of intercepted web traffic and browsing habits.",
    "Open the Windows Certificate Manager (certmgr.msc) and forcefully remove any rogue Root Certificates installed by the adware.",
    "Remove the unauthorized local proxy configuration and flush the DNS cache.",
    "Deploy specialized adware removal utilities to scrub the registry of Zamg's persistence mechanisms and scheduled tasks."
  ],
  "what_to_avoid": [
    "Do not allow the user to log into any secure corporate portals while the machine is infected, as the local proxy intercepts SSL traffic.",
    "Avoid relying solely on Chrome or Edge's 'Reset Settings' button, as Zamg's scheduled tasks will simply reinstall the malicious extensions."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}