Linkury

Overview

Adware:Win32/Linkury is a massive, highly organized adware and click-fraud network that aggressively monetizes infected endpoints through forced advertisements and traffic redirection.

Understanding Linkury
To the end-user, Linkury renders a computer nearly unusable by injecting in-text hyperlinks, pop-up ads, and fake security warnings into every visited webpage. For security analysts, Linkury represents a severe compromise of the browser's security boundary. It acts as a Man-in-the-Browser (MitB), utilizing local proxies and rogue root certificates to intercept and decrypt SSL/TLS traffic, allowing it to inject ads even on secure HTTPS sites.

Execution and Evasion Strategies
Linkury is distributed via pay-per-install (PPI) software bundlers. Once installed, it drops its Smartbar (or similar toolbars) and rogue extensions across all browsers. It establishes persistence by modifying the Windows Internet Options to route all traffic through a local proxy (usually <code>127.0.0.1) controlled by the adware. It protects its components by installing a Windows Service that actively monitors the registry; if a user attempts to remove the proxy settings, the service instantly reverts them.

Indicators of Compromise (IoCs)
Incident responders should immediately audit the Windows Certificate Store for unauthorized, self-signed Root CAs, which Linkury uses to facilitate its HTTPS interception. Threat hunters will find anomalous proxy configurations in the registry (HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings). Network logs will reveal massive volumes of HTTP GET requests directed at known ad-tracking and affiliate networks.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1185: Enforce strong MFA and use browser isolation or hardened browsers for sensitive financial or administrative portals to defeat session hijacking.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_LINKURY {
    meta:
        description = "Detects Linkury (adware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "linkury" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Linkury Activity
id: af35fdbca9f815ee93c4740ce7296349
status: experimental
description: Detects generic indicators of the linkury malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*linkury*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Quarantine the endpoint to halt the exfiltration of intercepted web traffic and prevent further click-fraud.
2. Open the Windows Certificate Manager (certmgr.msc) and forcefully delete any rogue Root Certificates installed by Linkury.
3. Remove the unauthorized local proxy configuration from Windows Internet Options and flush the DNS cache.
4. Audit the Windows Services (services.msc) to identify and disable the watchdog service protecting the adware.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not allow the user to log into secure corporate or financial portals while infected, as Linkury decrypts and inspects all SSL traffic.
2. Avoid relying solely on Chrome's extension manager for removal; the local proxy and Windows Service must be neutralized first.

References & External Analysis

• Search "linkury" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: adware)

Explore other malware families in the same category:

• Appster
• Mywebsearch
• Wizzmonetize
• Swizzor
• Bettersurf

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/linkury.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.