{
  "family": "fusioncore",
  "sample_count": 104,
  "category": "adware",
  "description": "Fusioncore (cataloged by Microsoft Defender as Adware:Win32/FusionCore, PUA:Win32/FusionCore, and SoftwareBundler:Win32/FusionCore) is a pervasive commercial software bundler framework and potentially unwanted application (PUA) monetization platform active since 2016. Operating within the Pay-Per-Install (PPI) monetization ecosystem, Fusioncore is integrated into installation packages for popular repackaged freeware applications, video file converters, and torrent software clients. During execution, the Fusioncore module quietly transmits hardware configuration, operating system locale, and telemetry parameters to backend monetization servers. It dynamically generates deceptive installation screens employing dark patterns, pre-selected checkboxes, and ambiguous opt-out prompts to coerce users into accepting third-party software bundles. In the background, Fusioncore installs unauthorized browser extensions, alters default search engines to sponsored landing portals, creates persistent desktop advertising shortcuts, and deploys registry watchdog entries to resist removal.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Adware:Win32/FusionCore",
    "PUA:Win32/FusionCore",
    "SoftwareBundler:Win32/FusionCore",
    "Adware.FusionCore",
    "Win32/FusionCore"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Adware:Win32/FusionCore framework?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Fusioncore is a Pay-Per-Install software bundler that monetizes freeware downloads by installing unwanted toolbars and adware."
      }
    },
    {
      "@type": "Question",
      "name": "How does Fusioncore trick users during software installation?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses deceptive installation wizards with pre-checked boxes and confusing language to install bundled software without clear consent."
      }
    },
    {
      "@type": "Question",
      "name": "What system changes are caused by Fusioncore?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It drops unwanted browser extensions, changes default search engines, and creates desktop and browser advertising shortcuts."
      }
    },
    {
      "@type": "Question",
      "name": "How is Fusioncore typically encountered by users?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled inside repackaged freeware downloads, media converters, and utilities on third-party download websites."
      }
    },
    {
      "@type": "Question",
      "name": "How can an infected system be cleared of Fusioncore?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall the parent software, run an antimalware scanner like Malwarebytes to remove persistent files, and reset browser settings."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1189",
    "T1562.001",
    "T1176",
    "T1105",
    "T1204.002",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Identify and uninstall the parent freeware application that contained the Fusioncore software bundler installer.",
    "Run an enterprise adware cleaner (such as Malwarebytes or Microsoft Defender) to detect and purge residual registry hooks and DLLs.",
    "Reset all installed web browsers to default configurations to eliminate unauthorized extensions and search redirection.",
    "Audit the Windows %AppData% and %Temp% directories for residual installer stubs and delete temporary files."
  ],
  "what_to_avoid": [
    "Do not rush through installer dialogs by clicking 'Next' without unchecking optional sponsored software offers.",
    "Avoid downloading freeware applications from unverified third-party mirror portals that bundle monetization modules."
  ],
  "target_industries": [
    "Global / Opportunistic",
    "Consumer Endpoints",
    "Educational Institutions"
  ],
  "motivation": "Adware Revenue",
  "threat_actors": [
    "Deceptive PPI Bundlers",
    "Affiliate Monetization Networks"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2016,
  "lineage": {
    "derived_from": [
      "Commercial PPI Bundlers"
    ],
    "variants": [
      "FusionCore.A",
      "FusionCore!rfn"
    ]
  },
  "iocs": {
    "file_hashes": [
      "1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d",
      "2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e"
    ],
    "delivery": [
      "Bundled into third-party freeware installers and utility download wrappers",
      "Malvertising redirects and deceptive software landing pages"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\FusionCore",
      "Browser shortcut (.LNK) argument modifications"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Adware:Win32/FusionCore",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/FusionCore"
    },
    {
      "name": "Malwarebytes Threat Intelligence - Adware.FusionCore",
      "url": "https://www.malwarebytes.com/blog/detections/adware-fusioncore"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}