{
  "family": "fontra",
  "sample_count": 25,
  "category": "adware",
  "description": "Fontra (cataloged in antimalware repositories under signatures including BrowserModifier:Win32/Fontra, Adware:Win32/Fontra, and PUA:Win32/Fontra) is an intrusive adware framework and browser modifier active since 2014. Distributed predominantly through deceptive web font download packages, graphic asset archives, and software bundlers, Fontra modifies web browser configurations across Google Chrome, Mozilla Firefox, and Internet Explorer. It alters homepage and default search engine settings to affiliate advertising portals, injects unwanted banner advertisements and floating commercial pop-ups into visited web pages, and intercepts URL navigation to generate pay-per-click advertising revenue. Fontra creates persistent scheduled tasks and registry autostart keys to maintain persistence on compromised endpoints.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "BrowserModifier:Win32/Fontra",
    "Adware:Win32/Fontra",
    "PUA:Win32/Fontra",
    "Win32/Fontra",
    "Fontra Adware"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is BrowserModifier:Win32/Fontra?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Fontra is an adware program and browser modifier that injects unwanted advertisements and redirects web browser searches."
      }
    },
    {
      "@type": "Question",
      "name": "How does Fontra get installed on systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled with free font packs, graphic design downloads, and deceptive software installation wrappers."
      }
    },
    {
      "@type": "Question",
      "name": "What browser changes are made by Fontra?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It redirects search engine queries, alters default homepages, and injects commercial ad banners into web pages."
      }
    },
    {
      "@type": "Question",
      "name": "How does Fontra persist on Windows computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It configures autorun registry keys under CurrentVersion\\Run and registers background scheduled maintenance tasks."
      }
    },
    {
      "@type": "Question",
      "name": "How do you completely remove Fontra?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall rogue entries via Windows Settings, reset browser configurations, and run a full scan with Microsoft Defender."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1176",
    "T1059.007",
    "T1112",
    "T1071.001",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2014,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Font Pack Downloads",
    "Software Bundler Wrappers",
    "Torrent Download Portals"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Browser Homepage & Search Hijacking",
    "In-Page Banner & Pop-Up Ad Injection",
    "Browser Extension Installation",
    "User Search Telemetry Scraping",
    "Registry Autostart & Task Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Setup Wrapper)",
      "Browser Helper Extension Module"
    ],
    "network_signatures": [
      "HTTP/HTTPS GET queries directing search traffic through affiliate tracking intermediate domains",
      "Periodic telemetry beacons transmitting host GUID and installation metrics"
    ],
    "evasion_techniques": [
      "Disguising executables as legitimate font installation utilities",
      "Running background watchdog processes to re-establish hijacked settings if deleted"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "15c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7",
      "26d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\FontraService",
      "HKCU\\Software\\Fontra"
    ],
    "file_paths": [
      "%ProgramFiles%\\Fontra\\fontra.exe",
      "%AppData%\\Fontra\\config.ini",
      "%LocalAppdata%\\Temp\\font_setup.tmp"
    ]
  },
  "defensive_measures": [
    "Enable Potentially Unwanted Application (PUA) blocking in Microsoft Defender",
    "Inspect desktop .lnk shortcuts for unauthorized appended URL parameters",
    "Block unprivileged users from installing browser extensions via Group Policy"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - BrowserModifier:Win32/Fontra",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=BrowserModifier:Win32/Fontra"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Adware.Win32.Fontra",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "BrowserModifier:Win32/Fontra.A",
      "Adware:Win32/Fontra.gen"
    ]
  },
  "motivation": "Advertising Monetization, Search Traffic Hijacking & Telemetry Collection",
  "sample_hashes": []
}