Inbox

Overview

BrowserModifier:Win32/Inbox is a highly prevalent browser hijacking framework and Potentially Unwanted Program (PUA) that forcibly alters a user's web browser configuration to redirect search traffic through affiliate networks (often involving an 'Inbox Toolbar'), generating illicit advertising revenue.

Understanding Inbox
To the victim, an Inbox infection is intensely frustrating. Their preferred homepage (e.g., Google or Bing) is replaced with a deceptive search portal. Every search query they enter is routed through tracking domains, exposing them to injected advertisements and potentially malicious search results. For a security analyst, Inbox represents a significant privacy violation and a vector for further infections, as the forced search results frequently lead to malware droppers.

Execution and Hijacking Strategies
Inbox is primarily distributed through deceptive software bundling (`T1189`). When a user installs freeware, the Inbox installer runs silently in the background. It aggressively modifies browser settings across Chrome, Firefox, Edge, and IE. It changes the default search provider registry keys (`T1112`) and installs malicious browser extensions or BHOs (`T1176`) to lock the settings in place. To ensure the user cannot easily revert the changes, it frequently deploys Windows Group Policy Objects (GPOs) or sets up scheduled tasks that act as a 'watchdog', reinstalling the extension if the user attempts to remove it.

Indicators of Compromise & Impact
The impact is a degraded user experience, loss of browsing privacy, and increased risk of secondary infections from malicious ads. Network logs will show all HTTP/HTTPS search traffic being redirected through unknown, third-party affiliate domains. EDR platforms should flag the unauthorized modification of browser preference files and the creation of restrictive GPOs by an untrusted installer.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_INBOX {
    meta:
        description = "Detects Inbox (advanced_threat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "inbox" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Inbox Activity
id: af1cd994dfcb9286c394d142687ff5a0
status: experimental
description: Detects generic indicators of the inbox malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*inbox*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Quarantine the endpoint to halt the active redirection of search traffic and the potential downloading of secondary malware via malicious ads.
2. Audit Windows Group Policies (`gpedit.msc`) and the Registry to remove any forced extension installation policies created by the hijacker.
3. Deploy an enterprise adware removal tool (e.g., AdwCleaner) to locate and strip the deeply embedded registry hooks and watchdog services.
4. Force a complete reset of all installed web browsers to factory defaults to eradicate the rogue extensions and restore the homepage.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not rely solely on the browser's 'remove extension' button; Inbox uses GPOs and watchdog services to immediately reinstall itself.
2. Avoid ignoring the infection; the redirected search traffic can expose corporate data if the user queries internal project names.

References & External Analysis

• Search "inbox" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: advanced_threat)

Explore other malware families in the same category:

• Eventmonitor
• Microfake
• Zugo
• Proinstall
• Opensupdater

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/inbox.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.