{
  "family": "searchpage",
  "sample_count": 17,
  "category": "browser_modifier",
  "description": "SearchPage (classified across endpoint security engines as BrowserModifier:Win32/SearchPage, Adware:Win32/SearchPage, and Trojan.BrowserModifier.SearchPage) is a persistent browser hijacker and search redirection tool engineered to monetize web traffic. Distributed primarily via bundled freeware installers, rogue browser extension prompts, and misleading torrent downloads, SearchPage hijacks user web browsing navigation by forcefully reconfiguring browser preferences across Google Chrome, Mozilla Firefox, and Microsoft Edge. Upon installation, it modifies shortcut targets (`.lnk` files) on the desktop and taskbar by appending URL parameters, changes default search engines, and replaces new tab homepages with syndicated search domains (such as searchpage.com). SearchPage intercepts search keywords, routes traffic through multiple intermediate redirection servers, and injects pay-per-click advertisements and promoted links ahead of organic results. To resist removal, SearchPage installs persistent background update monitors that restore modified browser settings if altered by the user.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "BrowserModifier:Win32/SearchPage",
    "Adware:Win32/SearchPage",
    "Win32/SearchPage",
    "SearchPage Hijacker",
    "Trojan.SearchPage"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is BrowserModifier:Win32/SearchPage?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "SearchPage is a browser modifier and hijacker that changes browser search engines and homepages to redirect traffic to ad networks."
      }
    },
    {
      "@type": "Question",
      "name": "How does SearchPage hijack browser shortcuts?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies browser .lnk shortcut properties on the desktop and taskbar to append malicious redirect URL arguments."
      }
    },
    {
      "@type": "Question",
      "name": "How does SearchPage prevent users from changing their search engine back?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It deploys background watchdog processes and scheduled tasks that continuously re-apply the malicious search configuration."
      }
    },
    {
      "@type": "Question",
      "name": "What risks does SearchPage pose to endpoint users?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It exposes users to deceptive advertisements, tracking of private web queries, and potential drive-by malware downloads."
      }
    },
    {
      "@type": "Question",
      "name": "How do you completely remediate a SearchPage browser infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Remove unwanted browser extensions, restore clean browser shortcut paths, delete watchdog scheduled tasks, and reset browser profiles."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1176",
    "T1547.009",
    "T1053.005",
    "T1112",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1546",
      "name": "Event Triggered Execution: Browser Shortcut Modification",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Use enterprise endpoint management tools to forcefully remove the rogue browser extensions and reset the default search providers.",
    "Audit the properties of all browser shortcuts (`.lnk` files) on the user's Desktop, Taskbar, and Start Menu to remove any appended malicious URLs.",
    "Check the local Group Policy Editor (`gpedit.msc`) for any policies enforcing the installation of specific extensions, and delete them.",
    "Deploy specialized adware removal tools (e.g., AdwCleaner) to locate and strip any deeply embedded registry hooks or watchdog services."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's internal 'reset' button; many hijackers use watchdog services to immediately re-apply the malicious settings.",
    "Avoid ignoring the infection, as the affiliate networks powering these hijackers often serve malicious advertisements (malvertising) that can lead to more severe infections."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - BrowserModifier:Win32/SearchPage",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=BrowserModifier:Win32/SearchPage"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - BrowserModifier.Win32.SearchPage",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/browsermodifier.win32.searchpage"
    },
    {
      "name": "MITRE ATT&CK - Shortcut Modification (T1547.009)",
      "url": "https://attack.mitre.org/techniques/T1547/009/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}