{
  "family": "bundlore",
  "sample_count": 16,
  "category": "adware",
  "description": "Bundlore (tracked across security vendors under designations including Adware:OSX/Bundlore, Adware:Win32/Bundlore, OSX.Bundlore, and Shlayer/Bundlore variant) is a cross-platform adware bundler and unwanted application distribution platform affecting both macOS and Microsoft Windows operating systems. Known for its sophisticated evasive packaging, Bundlore typically masquerades as illegitimate media players, Flash Player updates, video converters, or software cracks hosted on malicious landing pages. Upon execution, Bundlore runs anti-analysis routines to detect virtual machines, debugging environments, and security monitoring software. The installer dynamically contacts remote advertising C2 servers to fetch encrypted configuration payloads. Bundlore extracts and installs multiple unwanted components, including rogue browser extensions, proxy configurations, and man-in-the-middle certificates. These components inject banners, pop-up ads, and affiliate tracking cookies into encrypted HTTPS web traffic, while establishing persistent autostart mechanisms (such as macOS LaunchAgents/LaunchDaemons or Windows Scheduled Tasks and Run registry entries).",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Adware:OSX/Bundlore",
    "Adware:Win32/Bundlore",
    "OSX/Bundlore",
    "Win32/Bundlore",
    "Bundlore Installer",
    "OSX.Bundlore"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Adware:Win32/Bundlore (OSX/Bundlore)?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Bundlore is a cross-platform adware bundler that distributes unwanted applications, browser hijackers, and ad-injectors on Windows and macOS."
      }
    },
    {
      "@type": "Question",
      "name": "How does Bundlore disguise its installation packages?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It masquerades as essential Flash Player updates, video codec packs, or software cracks hosted on misleading download sites."
      }
    },
    {
      "@type": "Question",
      "name": "How does Bundlore inject ads into secure HTTPS traffic?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It installs local root certificates or proxy extensions to perform man-in-the-middle ad insertion into encrypted web pages."
      }
    },
    {
      "@type": "Question",
      "name": "What persistence methods does Bundlore use?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "On Windows it creates scheduled tasks and Run registry keys; on macOS it registers LaunchAgents and LaunchDaemons."
      }
    },
    {
      "@type": "Question",
      "name": "How can administrators remove Bundlore adware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Delete unauthorized browser extensions, remove rogue LaunchAgents/LaunchDaemons or scheduled tasks, and purge rogue root certificates."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1176",
    "T1543.001",
    "T1543.004",
    "T1547.001",
    "T1053.005",
    "T1553.004",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1546",
      "name": "Event Triggered Execution: Browser Shortcut Modification",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Use enterprise endpoint management tools to forcefully remove the rogue browser extensions and reset the default search providers.",
    "Audit the properties of all browser shortcuts (`.lnk` files) on the user's Desktop, Taskbar, and Start Menu to remove any appended malicious URLs.",
    "Use the Windows Control Panel to uninstall the bundled applications, followed by deploying an adware removal tool (e.g., AdwCleaner) to strip the remaining Scheduled Tasks and registry hooks.",
    "Force a complete reset of all installed web browsers to factory defaults."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's 'remove extension' button; Bundlore uses watchdog services (Scheduled Tasks) to immediately re-apply the malicious settings.",
    "Avoid ignoring the infection; the affiliate networks powering these hijackers often serve malicious advertisements (malvertising) that can lead to severe malware infections."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Adware:Win32/Bundlore",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Bundlore"
    },
    {
      "name": "Sophos Threat Center - OSX/Bundlore Technical Analysis",
      "url": "https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/OSX~Bundlore-A"
    },
    {
      "name": "MITRE ATT&CK - Subvert Trust Controls: Install Root Certificate (T1553.004)",
      "url": "https://attack.mitre.org/techniques/T1553/004/"
    }
  ],
  "target_platforms": [
    "macOS"
  ]
}