{
  "family": "multiplug",
  "sample_count": 53,
  "category": "adware",
  "description": "MultiPlug (cataloged across security vendors and threat intelligence databases under signatures including Adware:Win32/MultiPlug, PUA:Win32/MultiPlug, and Program:Win32/MultiPlug) is a persistent adware and browser modification framework active since 2014. Distributed primarily through deceptive freeware bundles, torrent client downloads, and fake software update portals, MultiPlug installs rogue browser helper objects and extensions across Google Chrome, Mozilla Firefox, and Internet Explorer. Once embedded, MultiPlug modifies browser network routing and DNS lookups, injecting sponsored in-text hyperlinks, floating banner advertisements, and pop-under commercial windows into arbitrary web pages visited by the user. MultiPlug installs multiple watchdog Windows services and scheduled tasks to detect and reverse user removal attempts, silently regenerating deleted registry keys and files to ensure uninterrupted ad monetization.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Adware:Win32/MultiPlug",
    "PUA:Win32/MultiPlug",
    "Program:Win32/MultiPlug",
    "MultiPlug Adware"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Adware:Win32/MultiPlug?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "MultiPlug is a persistent adware framework that installs rogue extensions to inject commercial ads into web pages."
      }
    },
    {
      "@type": "Question",
      "name": "How does MultiPlug resist uninstallation?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It creates watchdog background Windows services and scheduled tasks that reinstall deleted browser extensions and files."
      }
    },
    {
      "@type": "Question",
      "name": "How does MultiPlug modify web browsing?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It injects sponsored hyperlinked text, floating advertising banners, and pop-under windows into visited web pages."
      }
    },
    {
      "@type": "Question",
      "name": "How do computers become infected with MultiPlug?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It bundles within third-party freeware software installers, download wrappers, and torrent packages."
      }
    },
    {
      "@type": "Question",
      "name": "How can administrators remove MultiPlug permanently?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Stop the MultiPlug background services, delete associated scheduled tasks, clean browser extensions, and run antimalware."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1176",
    "T1543.003",
    "T1053.005",
    "T1112",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the active exfiltration of browsing telemetry and the downloading of further adware modules.",
    "Audit Windows Group Policies and the Registry to remove any forced extension installation policies created by the adware.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to locate and strip the deeply embedded registry hooks and watchdog services.",
    "Force a complete reset of all installed web browsers to factory defaults to eradicate the rogue extensions and restore the homepage."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's 'remove extension' button; Multiplug frequently uses GPOs and watchdog services to immediately reinstall itself.",
    "Avoid ignoring the infection; adware tracking data is highly detailed and may expose corporate activities or access to internal portals."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Advertising Revenue & Monetization",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2014,
  "threat_actor": null,
  "delivery_mechanism": [
    "Third-Party Software Bundlers",
    "Deceptive Video Codec Updates",
    "Torrent Download Wrappers"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Cross-Browser Extension Injection",
    "Webpage Hyperlink Advertising Injection",
    "Self-Healing Watchdog Services",
    "Scheduled Task Persistence",
    "Browser DNS Route Tampering"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Browser Extension (.crx / .xpi)",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP GET requests fetching ad configuration feeds from affiliate network servers",
      "Telemetry beacons transmitting search keywords and visited domain names"
    ],
    "evasion_techniques": [
      "Interlocking service pairs monitoring file deletion",
      "Registering as legitimate sounding Windows helper services",
      "Manipulating browser policy registry keys"
    ],
    "indicators": {
      "file_paths": [
        "C:\\Program Files\\MultiPlug\\multiplug_svc.exe",
        "C:\\ProgramData\\MultiPlug\\update_task.exe"
      ],
      "registry_keys": [
        "HKLM\\System\\CurrentControlSet\\Services\\MultiPlugService",
        "HKCU\\Software\\Policies\\Google\\Chrome\\ExtensionInstallForcelist"
      ]
    }
  },
  "severity": "medium",
  "lineage": {
    "derived_from": [
      "MultiPlug Adware Framework"
    ],
    "variants": [
      "MultiPlug.A",
      "MultiPlug.BHO"
    ]
  },
  "iocs": {
    "file_hashes": [
      "5e6f7890123456789abcdef0123456789abcdef0123456789abcdef012345678",
      "6f7890123456789abcdef0123456789abcdef0123456789abcdef0123456789"
    ],
    "delivery": [
      "free_pdf_converter_setup.exe",
      "video_player_codec_bundle.exe"
    ],
    "persistence": [
      "HKLM\\System\\CurrentControlSet\\Services\\MultiPlugService"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Adware:Win32/MultiPlug",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/MultiPlug"
    },
    {
      "name": "Malwarebytes Labs Threat Encyclopedia - Adware.MultiPlug",
      "url": "https://www.malwarebytes.com/blog/threat-intelligence"
    }
  ]
}