{
  "family": "babylon",
  "sample_count": 25,
  "category": "adware",
  "description": "Babylon (classified across antimalware research repositories under signatures including BrowserModifier:Win32/Babylon, Adware:Win32/Babylon, and PUA:Win32/BabylonToolbar) is a landmark browser hijacker, monetization toolbar, and search-redirector framework originally distributed alongside the Babylon desktop translation software and deceptive freeware installers from 2011 to 2015. Widely flagged by Microsoft Defender and antimalware vendors worldwide, Babylon forcefully alters user browser homepages and default search engines to isearch.babylon.com, intercepts URL navigation bars, and installs stubborn Browser Helper Objects (BHOs). The software actively blocks attempts to restore native browser settings and transmits browsing queries to third-party ad networks, leading to major global complaints and widespread enterprise PUA classification.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "BrowserModifier:Win32/Babylon",
    "Adware:Win32/Babylon",
    "PUA:Win32/BabylonToolbar",
    "Babylon Search",
    "Babylon Toolbar",
    "Win32/Babylon"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Babylon Toolbar / Search hijacker?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Babylon is a notorious browser hijacker and toolbar that redirects searches to isearch.babylon.com and installs stubborn BHOs."
      }
    },
    {
      "@type": "Question",
      "name": "How did Babylon infect millions of computers worldwide?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It was aggressively bundled with free translation tools, download managers, and CNET/Download.com installers using pre-checked boxes."
      }
    },
    {
      "@type": "Question",
      "name": "What modifications does Babylon make to browsers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It locks the homepage and new tab page to Babylon Search, changes default search engines, and monitors web queries."
      }
    },
    {
      "@type": "Question",
      "name": "Why is Babylon considered difficult to remove?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Standard uninstallation often left rogue registry values, LSP network hooks, and helper objects that continued to redirect traffic."
      }
    },
    {
      "@type": "Question",
      "name": "How can you eradicate Babylon completely from a system?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall Babylon from Programs and Features, reset browser settings, delete Babylon folders in Program Files and AppData, and scan with Defender."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1176",
    "T1059.007",
    "T1112",
    "T1071.001",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2011,
  "threat_actor": null,
  "delivery_mechanism": [
    "Software Bundlers on Freeware Portals",
    "Babylon Translation Software Installers",
    "Deceptive Download Manager Wrappers"
  ],
  "target_platforms": [
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows XP"
  ],
  "capabilities": [
    "Forced Homepage & Default Search Hijacking (isearch.babylon.com)",
    "Browser Helper Object (BHO) Installation",
    "New Tab Page Redirection",
    "Search Query Interception & Ad Monetization",
    "Persistent Background Updater Service"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Toolbar Service)",
      "Browser Helper Object DLL (BabylonToolbar.dll)"
    ],
    "network_signatures": [
      "High volume of search queries redirected to isearch.babylon.com containing affiliate monetization tokens",
      "HTTP GET requests fetching sponsored ad links and contextual keywords"
    ],
    "evasion_techniques": [
      "Modifying browser preferences files directly in user profiles to lock search settings",
      "Running background watchdog processes to re-establish hijacked homepages"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "37c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6",
      "48d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7"
    ],
    "registry_keys": [
      "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects\\{2EECD738-5844-4A99-B4B6-146BF802613B}",
      "HKCU\\Software\\BabylonToolbar"
    ],
    "file_paths": [
      "%ProgramFiles%\\BabylonToolbar\\BabylonToolbar\\1.8.38.17\\BabylonToolbarApp.exe",
      "%AppData%\\Babylon\\config.xml"
    ]
  },
  "defensive_measures": [
    "Enforce administrative policies blocking installation of Browser Helper Objects (BHOs) in Internet Explorer/Edge",
    "Enable Potentially Unwanted Application (PUA) blocking across enterprise antimalware policies",
    "Block outbound web access to known Babylon search-arbitrage and tracking domains"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - BrowserModifier:Win32/Babylon",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=BrowserModifier:Win32/Babylon"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - PUA.Win32.Babylon",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "BrowserModifier:Win32/Babylon.A",
      "PUA:Win32/BabylonToolbar.gen"
    ]
  },
  "motivation": "Search Traffic Arbitrage, Advertising Monetization & Telemetry Harvesting",
  "sample_hashes": []
}