{
  "family": "hijacker",
  "sample_count": 92,
  "category": "adware",
  "description": "Hijacker (cataloged across security vendors as BrowserModifier:Win32/Hijacker, Adware:Win32/Hijacker, and Trojan:Win32/Hijacker) is a widespread family of persistent browser manipulation programs and adware frameworks active since 2013. Designed to monetize web browsing sessions without user consent, Hijacker is distributed through pay-per-install software bundlers, fake software update prompts, and malicious browser extension marketplaces. Once executed on Windows, Hijacker makes deep modifications to browser preferences across Google Chrome, Mozilla Firefox, and Microsoft Edge. It forcibly alters default search engines, new tab pages, and start pages to redirect queries through affiliate monetization hubs. To prevent remediation, Hijacker modifies Windows Registry Group Policies (such as ExtensionInstallForcelist and HomepageLocation), displaying 'Managed by your organization' within Chrome to block user uninstall attempts. In addition to search hijacking, Hijacker injects banner advertisements into websites and monitors search queries and visited URLs to harvest tracking telemetry.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "BrowserModifier:Win32/Hijacker",
    "Adware:Win32/Hijacker",
    "Trojan:Win32/Hijacker",
    "Win32/Hijacker"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is BrowserModifier:Win32/Hijacker?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Hijacker is an adware and browser modification threat that overrides default search engines, homepages, and new tab URLs."
      }
    },
    {
      "@type": "Question",
      "name": "How does Hijacker infect web browsers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through deceptive free software installers, fake media player updates, and rogue browser extension download portals."
      }
    },
    {
      "@type": "Question",
      "name": "Why does Chrome display 'Managed by your organization' during infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Hijacker creates administrative Group Policy registry keys to force-install rogue extensions and prevent the user from disabling them."
      }
    },
    {
      "@type": "Question",
      "name": "Does Hijacker track user web browsing activity?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, it collects search queries, URLs visited, IP addresses, and hardware information to serve targeted advertisements."
      }
    },
    {
      "@type": "Question",
      "name": "How can users completely remove BrowserModifier:Win32/Hijacker?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Remove malicious Group Policy keys in the registry, reset browser settings to default, uninstall rogue applications, and run an antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.002",
    "T1189",
    "T1547.001",
    "T1176",
    "T1112",
    "T1059.003",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the active exfiltration of browsing telemetry and the downloading of further adware modules.",
    "Audit Windows Group Policies and the Registry to remove any forced extension installation policies created by the hijacker.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to locate and strip the deeply embedded registry hooks and watchdog services.",
    "Check all browser desktop shortcuts (Right Click -> Properties) and remove any malicious URLs appended to the 'Target' field."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's native 'remove extension' button; Hijackers are explicitly designed to bypass or disable this functionality.",
    "Avoid ignoring the infection; the tracking infrastructure actively harvests browsing habits, which may include access to sensitive portals."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Adware Revenue",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2013,
  "threat_actor": null,
  "delivery_mechanism": [
    "Pay-Per-Install Software Bundlers",
    "Fake Flash/Browser Update Prompts",
    "Third-Party Download Portals"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Search Engine Redirection",
    "Homepage Hijacking",
    "Group Policy Manipulation",
    "Ad Injection",
    "Browsing History Telemetry"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 EXE",
      "Browser Extension (CRX)",
      "Registry Script"
    ],
    "network_signatures": [
      "HTTP search query redirects to syndicated search portals",
      "Encrypted telemetry uploads detailing search history"
    ],
    "evasion_techniques": [
      "Enterprise group policy locking to prevent manual browser extension removal",
      "Shortcut manipulation appending target URLs"
    ],
    "persistence_mechanisms": [
      "HKLM\\Software\\Policies\\Google\\Chrome\\ExtensionInstallForcelist",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\BrowserHijacker"
    ]
  },
  "impact": {
    "confidentiality": "Low",
    "integrity": "Medium",
    "availability": "Low",
    "scope": "Browser security policies, search integrity, user privacy"
  },
  "lineage": {
    "derived_from": [
      "Commercial Browser Hijackers"
    ],
    "variants": [
      "Hijacker.A",
      "Hijacker.SearchModifier"
    ]
  },
  "iocs": {
    "file_hashes": [
      "1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b7c6d5e4f3a2b1c0d",
      "6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b7c6d5e"
    ],
    "delivery": [
      "chrome_setup_update.exe",
      "search_assistant.exe"
    ],
    "persistence": [
      "HKLM\\Software\\Policies\\Google\\Chrome\\ExtensionInstallForcelist",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SearchEnhancer"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - BrowserModifier:Win32/Hijacker",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=BrowserModifier:Win32/Hijacker"
    },
    {
      "name": "Malwarebytes Labs - Browser Hijacker Removal Guide",
      "url": "https://www.malwarebytes.com/browser-hijacker"
    }
  ]
}