{
  "family": "redirect",
  "sample_count": 16,
  "category": "browser_modifier",
  "description": "Redirect (classified in antimalware definitions under BrowserModifier:Win32/Redirect, Adware:Win32/Redirect, and Trojan.BrowserModifier.Redirect) is a deceptive browser modification and traffic hijacking adware family. Infiltrating Windows endpoints via bundled software installers, deceptive freeware portals, and pirated media packages, Redirect systematically compromises web browsing integrity. It modifies the Windows Hosts file (`%SystemRoot%\\System32\\drivers\\etc\\hosts`) to map legitimate search domains to malicious ad-serving IPs, adjusts system-wide proxy settings under `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings`, and injects unauthorized extensions into Google Chrome, Mozilla Firefox, and Microsoft Edge. When users attempt to perform web searches or navigate to banking and e-commerce websites, Redirect intercepts the requests and reroutes traffic through intermediate advertising syndicates and affiliate tracking domains. The malware injects commercial banners, triggers unsolicited pop-under advertisements, and logs browsing queries without user consent.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "BrowserModifier:Win32/Redirect",
    "Adware:Win32/Redirect",
    "Win32/Redirect",
    "Redirect Hijacker",
    "Trojan.BrowserModifier.Redirect"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is BrowserModifier:Win32/Redirect?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Redirect is an adware and browser modifier that hijacks web traffic by altering proxy configurations and the Windows hosts file."
      }
    },
    {
      "@type": "Question",
      "name": "How does Redirect manipulate Windows networking settings?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies the Windows Hosts file and sets custom proxy servers in the registry to reroute outbound HTTP/HTTPS traffic."
      }
    },
    {
      "@type": "Question",
      "name": "What symptoms indicate a Redirect infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Frequent browser redirects to unknown landing pages, unwanted pop-up ads, changed search engines, and slow browsing performance."
      }
    },
    {
      "@type": "Question",
      "name": "How does Redirect collect user data?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It logs entered search terms, visited URLs, IP addresses, and browsing patterns to serve targeted commercial advertising."
      }
    },
    {
      "@type": "Question",
      "name": "How do you completely remove Redirect from a PC?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Reset the Windows Hosts file to default, disable rogue proxy settings in Internet Options, remove rogue extensions, and run an antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1176",
    "T1112",
    "T1547.001",
    "T1053.005",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1090",
      "name": "Proxy",
      "tactic": "Command and Control"
    },
    {
      "id": "T1546",
      "name": "Event Triggered Execution: Browser Shortcut Modification",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Open the Windows Internet Options and manually check the LAN Settings to disable any rogue proxy configurations established by the malware.",
    "Use enterprise endpoint management tools to forcefully remove all unrecognized browser extensions and reset the default search providers.",
    "Audit the properties of all browser shortcuts (`.lnk` files) on the user's Desktop and Taskbar to remove any appended malicious URLs.",
    "Check the local `hosts` file (`C:\\Windows\\System32\\drivers\\etc\\hosts`) for unauthorized DNS mappings and restore it to default."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's internal 'reset' button; if a system-level proxy is set, the browser reset will not fix the redirection issue.",
    "Avoid assuming the infection is harmless; aggressive redirect chains often end at Exploit Kits that can drop ransomware or banking trojans."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - BrowserModifier:Win32/Redirect",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=BrowserModifier:Win32/Redirect"
    },
    {
      "name": "Trend Micro Security Research - BrowserModifier.Win32.Redirect Overview",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/browsermodifier.win32.redirect"
    },
    {
      "name": "MITRE ATT&CK - Modify Registry (T1112)",
      "url": "https://attack.mitre.org/techniques/T1112/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}