{
  "family": "inbox",
  "sample_count": 22,
  "category": "adware",
  "description": "Inbox (widely cataloged across security solutions under designations including BrowserModifier:Win32/Inbox, Adware:Win32/Inbox, and PUA:Win32/InboxAce) is a pervasive browser hijacker and adware toolbar family developed by monetization networks (such as Mindspark/IAC). Distributed through deceptive software bundles, fake search bars, and free game installers, Inbox alters internet browser configurations across Google Chrome, Mozilla Firefox, and Internet Explorer. It silently modifies the default search engine, home page, and new tab settings to point to affiliate search engines (such as InboxAce search or customized Ask/MyWay portals). It injects commercial advertising banners, sponsored search results, and pop-up windows while monitoring browsing navigation and query keywords for behavioral advertising targeting.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "BrowserModifier:Win32/Inbox",
    "Adware:Win32/Inbox",
    "PUA:Win32/InboxAce",
    "Toolbar:Win32/Inbox",
    "Win32/InboxAce"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is BrowserModifier:Win32/Inbox?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Inbox is a browser hijacker and adware toolbar that alters browser search engines and homepages to display commercial ads."
      }
    },
    {
      "@type": "Question",
      "name": "How does Inbox hijack web browser configurations?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies browser preference files, injects unauthorized extensions, and overrides default search providers."
      }
    },
    {
      "@type": "Question",
      "name": "How is the Inbox toolbar installed on user devices?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled into third-party software installers, free games, and deceptive search utility downloads."
      }
    },
    {
      "@type": "Question",
      "name": "Does Inbox monitor user browsing activities?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, it tracks search queries, clicked links, and visited web pages to deliver targeted behavioral advertisements."
      }
    },
    {
      "@type": "Question",
      "name": "How can the Inbox browser hijacker be completely removed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall via Windows Control Panel, remove extensions from Chrome, Firefox, and Edge, reset browser settings, and run an antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1189",
    "T1112",
    "T1547.001",
    "T1056.001",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - BrowserModifier:Win32/Inbox",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=BrowserModifier:Win32/Inbox"
    },
    {
      "name": "Malwarebytes Labs - Adware.Inbox Toolbar Removal Guide",
      "url": "https://www.malwarebytes.com/blog/detections/adware-inbox"
    },
    {
      "name": "Sophos Threat Center - Inbox Toolbar Detection",
      "url": "https://www.sophos.com/en-us/threat-center/threat-analyses"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Terminate active browser processes and associated toolbar helper applications.",
    "Uninstall the Inbox toolbar via Windows Programs and Features.",
    "Remove rogue Inbox extensions and add-ons across Chrome, Firefox, and Edge.",
    "Restore browser default search provider, start page, and new tab URLs.",
    "Run a full antimalware scan to purge persistent registry modifications and cache files."
  ],
  "what_to_avoid": [
    "Do not click on sponsored search links or promotional banners injected by the toolbar.",
    "Do not agree to bundle offers during third-party freeware installations."
  ],
  "target_industries": [
    "Consumer Endpoints",
    "Corporate Workstations"
  ],
  "target_geographies": [
    "Global"
  ],
  "threat_actors": [
    "Adware Syndicates & Browser Toolbar Monetization Networks"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "collection"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Search Traffic Monetization & Affiliate Advertising",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}