Bundlore

Overview

Adware:Win32/Bundlore (also highly prevalent on macOS as OSX/Bundlore) is a prolific and aggressive adware bundler framework. It specializes in using deceptive installation wrappers to silently deploy browser hijackers, unwanted toolbars, and tracking software alongside legitimate or pirated applications.

Understanding Bundlore
To an end-user, Bundlore is a massive annoyance. After downloading a 'free' utility (like a PDF converter or a flash player update), their web browser is hijacked: the homepage changes, search results are flooded with sponsored links, and pop-up ads appear constantly. For security analysts, Bundlore operates on a sophisticated Pay-Per-Install (PPI) model. The attackers monetize the initial infection by forcibly injecting affiliate advertisements into the user's web traffic and harvesting their browsing telemetry.

Execution and Deceptive Bundling
Bundlore relies entirely on social engineering and deceptive UI/UX ('Dark Patterns') during the installation phase (`T1189`). The primary installer executes and presents a standard End User License Agreement (EULA). However, hidden behind 'Advanced' or 'Custom' installation menus are pre-checked boxes authorizing the installation of multiple 'special offers' (the adware payloads). Once authorized, Bundlore drops and installs rogue browser extensions (`T1176`) and frequently modifies the shortcut files (`.lnk`) for Chrome, Firefox, and Edge to append malicious URLs to the target path (`T1546`). It establishes persistence using Scheduled Tasks (`T1053.005`) to monitor the browser and reinstall the adware if the user attempts to remove it.

Indicators of Compromise & Impact
The primary impact is a degraded user experience, loss of productivity, and severe privacy violations due to the constant exfiltration of search history. EDR platforms will flag the initial installer executing `wscript.exe` or PowerShell scripts to modify browser preferences and create unauthorized Scheduled Tasks. Network logs will reveal anomalous routing of standard HTTP traffic through affiliate marketing networks.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_BUNDLORE {
    meta:
        description = "Detects Bundlore (advanced_threat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "bundlore" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Bundlore Activity
id: b867cf15f43315161667ae9212a1c81a
status: experimental
description: Detects generic indicators of the bundlore malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*bundlore*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Use enterprise endpoint management tools to forcefully remove the rogue browser extensions and reset the default search providers.
2. Audit the properties of all browser shortcuts (`.lnk` files) on the user's Desktop, Taskbar, and Start Menu to remove any appended malicious URLs.
3. Use the Windows Control Panel to uninstall the bundled applications, followed by deploying an adware removal tool (e.g., AdwCleaner) to strip the remaining Scheduled Tasks and registry hooks.
4. Force a complete reset of all installed web browsers to factory defaults.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not rely solely on the browser's 'remove extension' button; Bundlore uses watchdog services (Scheduled Tasks) to immediately re-apply the malicious settings.
2. Avoid ignoring the infection; the affiliate networks powering these hijackers often serve malicious advertisements (malvertising) that can lead to severe malware infections.

References & External Analysis

• Search "bundlore" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: advanced_threat)

Explore other malware families in the same category:

• Kido
• Activitymonitor
• Daum
• Installiq
• Extcrome

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/bundlore.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.