Conduit

Overview

Adware:Win32/Conduit is the detection name for one of the most infamous and widespread **Browser Hijackers** in the history of the internet. Distributed by the company Conduit Ltd. (later Perion), it primarily manifested as the 'Conduit Search' toolbar. While technically legal at the time, its extremely aggressive distribution methods, difficulty of removal, and invasive data collection led the cybersecurity industry to universally classify it as a Potentially Unwanted Program (PUP) and Adware.

Understanding Conduit (The Toolbar Epidemic)
To an end-user, Conduit was a massive source of frustration. It forcibly changed the browser's default homepage, new tab page, and search engine to `search.conduit.com`, injecting sponsored links and advertisements into all web results. For a security team, Conduit represented a severe compromise of endpoint hygiene and a vector for data leakage, as it tracked vast amounts of user browsing behavior (`T1562.001`).

Execution and Hijacking Mechanics
Conduit was almost always distributed via Pay-Per-Install (PPI) software bundles (`T1189`). When a user installed freeware (like a PDF reader or media player), the installer silently dropped the Conduit payload. It established deep persistence by registering as a Browser Helper Object (BHO) in Internet Explorer, an extension in Chrome/Firefox (`T1176`), and heavily modifying the Windows Registry (`T1112`) to ensure its search engine could not be easily reverted by the user. If a user tried to manually change their homepage back to Google, Conduit's background service would simply rewrite the registry key on the next reboot.

Indicators of Compromise & Impact
The impact was a severely degraded user experience and significant privacy violations. Host-based IoCs include the presence of Conduit/Perion folders in `Program Files`, registry keys containing 'Conduit', and the presence of associated BHOs. Network IoCs include all search traffic being forcibly routed through `search.conduit.com` or its affiliate networks.

Known aliases

Threat reports may refer to this family under multiple names:

• Adware:Win32/Conduit
• Conduit Search
• Conduit Toolbar
• Search Protect by Conduit
• Win32/Conduit

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_CONDUIT_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Conduit"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "conduit" ascii wide nocase
        $s2 = "adware:win32/conduit" ascii wide nocase
        $s3 = "conduit search" ascii wide nocase
        $s4 = "conduit toolbar" ascii wide nocase
        $s5 = "search protect by conduit" ascii wide nocase
        $s6 = "win32/conduit" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Conduit (Adware) Execution & Triage
id: 156d1ea5-c3ad-5eed-aa61-26126f77835f
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Conduit malware family. Detects suspicious execution from temporary user
  directories with hidden window flags and background transfer utilities.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/conduit
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.adware
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1189
- attack.t1562_001
- attack.t1176
- attack.t1112
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \cscript.exe
    - \wscript.exe
    CommandLine|contains:
    - AppData\Local\Temp
    - -WindowStyle Hidden
    - /e:jscript
    - bitsadmin /transfer
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: medium

rule MALWARE_WIN_CONDUIT_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Conduit tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "conduit" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Use the Windows Control Panel to thoroughly uninstall any programs published by 'Conduit', 'Perion', 'ClientConnect', or 'Spigot'.
2. Manually remove any remaining 'Conduit Search' or 'Search Protect' extensions from all installed web browsers.
3. Reset all web browsers (Chrome, Edge, Firefox, IE) to their absolute default settings to clear out hijacked homepages and search engines.
4. Run a deep scan with an enterprise-grade Adware removal tool (like AdwCleaner or Malwarebytes) to purge the deeply embedded registry persistence.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not attempt to just change the homepage manually; the Conduit background services will instantly revert the changes.
2. Avoid allowing users to download software from unverified third-party download portals, which was the primary vector for Conduit.

References & External Analysis

• Search "conduit" on VirusTotal (External Analysis)
• Search "conduit" on Any.Run (Sandbox Sandbox)
• Search "conduit" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Adware)

Explore other documented threats in the same operational category:

• Xetapp
• Browsefox
• Temonde
• Addrop
• Downloadassistant
• Advancedpccare
• Swizzor
• Installermonetizer

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/conduit.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.