{
  "family": "neobar",
  "sample_count": 21,
  "category": "adware",
  "description": "Neobar (identified across endpoint security vendors as BrowserModifier:Win32/Neobar, Adware:Win32/Neobar, and PUA:Win32/Neobar) is an aggressive browser modifier and adware toolbar framework. Distributed through deceptive software bundlers, free utility repacks, and download wrappers, Neobar embeds itself into web browsers including Internet Explorer, Google Chrome, and Mozilla Firefox. Upon installation, it forcibly alters browser default search settings, start pages, and error pages, redirecting user queries to monetization portals and affiliate search engines. Neobar injects sponsored links, commercial banner advertisements, and unexpected promotional pop-ups into visited web pages. It establishes persistent startup registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and registers background scheduled updater tasks, continuously transmitting browsing history telemetry to advertising aggregators.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "BrowserModifier:Win32/Neobar",
    "Adware:Win32/Neobar",
    "PUA:Win32/Neobar",
    "Toolbar:Win32/Neobar",
    "Win32/Neobar"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is BrowserModifier:Win32/Neobar?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Neobar is an adware toolbar and browser modifier that changes browser search settings to display affiliate ads."
      }
    },
    {
      "@type": "Question",
      "name": "How does Neobar enter computer systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It enters bundled within freeware installers, third-party download wrappers, and counterfeit software patches."
      }
    },
    {
      "@type": "Question",
      "name": "What browser modifications are made by Neobar?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It overrides the default search engine, homepage, and new tab pages, while injecting commercial pop-ups into web pages."
      }
    },
    {
      "@type": "Question",
      "name": "Does Neobar compromise user privacy?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, it tracks web browsing navigation, search queries, and clicked links to deliver targeted behavioral advertisements."
      }
    },
    {
      "@type": "Question",
      "name": "How can Neobar be completely removed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall via Windows Settings, remove rogue extensions across browsers, reset browser configurations, and run an antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1189",
    "T1112",
    "T1547.001",
    "T1056.001",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - BrowserModifier:Win32/Neobar",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=BrowserModifier:Win32/Neobar"
    },
    {
      "name": "Malwarebytes Labs - Adware.Neobar Removal Guide",
      "url": "https://www.malwarebytes.com/blog/detections/adware-neobar"
    },
    {
      "name": "Sophos Threat Center - Neobar Analysis",
      "url": "https://www.sophos.com/en-us/threat-center/threat-analyses"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Terminate active browser processes and associated toolbar helper applications.",
    "Uninstall Neobar via Windows Programs and Features / Settings.",
    "Remove rogue Neobar extensions and add-ons across Chrome, Firefox, and Edge.",
    "Reset browser default search engine and home page configurations.",
    "Run an updated antimalware scan to purge persistent registry keys and adware tracking modules."
  ],
  "what_to_avoid": [
    "Do not click on sponsored search links or promotional banners injected into websites.",
    "Do not accept default bundle checkboxes during third-party freeware installations."
  ],
  "target_industries": [
    "Consumer Endpoints",
    "Enterprise Workstations"
  ],
  "target_geographies": [
    "Global"
  ],
  "threat_actors": [
    "Commercial Software Monetization Networks & Adware Syndicates"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "collection"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Search Traffic Monetization & Affiliate Advertising",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}