{
  "family": "perion",
  "sample_count": 17,
  "category": "adware",
  "description": "Perion (classified across cybersecurity vendors as BrowserModifier:Win32/Perion, Adware:Win32/Perion, and PUA:Win32/Perion) represents a widespread adware, toolbar, and browser modification framework historically tied to monetized software bundling ecosystems (including SweetPacks, IncrediBar, and ClientConnect). Distributed via third-party freeware download aggregators, bundled installers, and deceptive online utility updates, Perion systematically alters web browser configuration settings across Google Chrome, Mozilla Firefox, and Microsoft Edge/Internet Explorer. Without transparent user consent, it replaces default search engines, start pages, and new tab handlers with syndicated search portals (such as Trovi or SweetIM). The software registers persistent Browser Helper Objects (BHOs), establishes Windows background updater services, and adds autostart registry entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. Perion monitors web browsing activities, intercepts user search queries, and injects commercial pop-up advertisements and affiliate tracking links into browsing sessions.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "BrowserModifier:Win32/Perion",
    "Adware:Win32/Perion",
    "PUA:Win32/Perion",
    "Perion Network Adware",
    "SweetPacks Perion"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is BrowserModifier:Win32/Perion?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Perion is an adware and browser modifier application that alters browser settings to redirect web traffic and inject affiliate ads."
      }
    },
    {
      "@type": "Question",
      "name": "How does Perion redirect web search queries?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies browser preferences and registers Browser Helper Objects (BHOs) to force queries through monetized portal domains."
      }
    },
    {
      "@type": "Question",
      "name": "How does Perion maintain persistence on Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It installs background service executables, registers daily scheduled tasks, and creates registry Run keys."
      }
    },
    {
      "@type": "Question",
      "name": "What privacy concerns are associated with Perion adware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It tracks user search terms, URLs visited, IP addresses, and browsing behavior to serve targeted commercial advertising."
      }
    },
    {
      "@type": "Question",
      "name": "How can users completely remove Perion?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall bundled utilities from Windows Settings, reset browser search engines and extensions, and run a malware remediation scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1176",
    "T1547.001",
    "T1053.005",
    "T1112",
    "T1056.001",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Use the Windows Control Panel to systematically uninstall all unrecognized or bundled software (e.g., search protectors, custom toolbars).",
    "Audit Windows Group Policies and the Registry to remove any forced extension installation policies created by the adware.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to locate and strip the deeply embedded registry hooks and watchdog services.",
    "Force a complete reset of all installed web browsers to factory defaults to eradicate the rogue extensions and restore the homepage."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's 'remove extension' button; Perion installers frequently use watchdog services to immediately reinstall themselves.",
    "Avoid ignoring the infection; the affiliate networks powering these hijackers often serve tracking cookies that violate corporate privacy policies."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - BrowserModifier:Win32/Perion",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=BrowserModifier:Win32/Perion"
    },
    {
      "name": "Malwarebytes Labs - PUP.Optional.Perion Analysis",
      "url": "https://www.malwarebytes.com/blog/detections/pup-optional-perion"
    },
    {
      "name": "MITRE ATT&CK - Browser Extensions (T1176)",
      "url": "https://attack.mitre.org/techniques/T1176/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}