{
  "family": "shyape",
  "sample_count": 50,
  "category": "adware",
  "description": "Shyape (cataloged across security vendors and threat intelligence databases under signatures including Adware:Win32/Shyape, Trojan.scar/shyape, and PUA:Win32/Shyape) is an invasive adware and potentially unwanted program (PUA) family active since 2016. Infiltrating endpoints through deceptive freeware installers, pirated media players, and infected removable USB drives, Shyape hooks local browser processes and helper objects to inject persistent advertisements and affiliate redirects into victim web sessions. Furthermore, advanced variants feature code injection capabilities that inject threads into legitimate Windows browser processes to evade local antimalware detection and ensure unhindered telemetry collection.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Adware:Win32/Shyape",
    "Trojan.scar/shyape",
    "PUA:Win32/Shyape",
    "Adware.Win32.Shyape",
    "Win32/Shyape"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Adware:Win32/Shyape?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Shyape is an invasive adware family that hooks browser processes to inject unwanted advertisements and redirect search traffic."
      }
    },
    {
      "@type": "Question",
      "name": "How does Shyape evade antivirus scanners?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It injects malicious threads into legitimate browser helper processes and uses stealthy startup registry hooks."
      }
    },
    {
      "@type": "Question",
      "name": "Can Shyape spread through USB flash drives?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, telemetry indicates certain variants propagate across removable storage drives by creating disguised shortcuts."
      }
    },
    {
      "@type": "Question",
      "name": "What impact does Shyape have on computer performance?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It causes high CPU utilization, browser crashes, slow page load times, and intrusive pop-up banners."
      }
    },
    {
      "@type": "Question",
      "name": "How can users remove Shyape from their endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Run a Microsoft Defender Full Scan, remove rogue browser extensions, and restore default browser settings."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1185",
    "T1055",
    "T1091",
    "T1547.001",
    "T1071.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Freeware Installers",
    "Removable USB Media Propagation",
    "Pirated Software & Codecs"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Browser In-Page Ad Injection",
    "Browser Process Code Injection",
    "USB Removable Drive Propagation",
    "Affiliate Tracking Telemetry",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP GET beacons fetching ad injection scripts from remote syndication servers",
      "Affiliate redirect traffic through click-fraud networks"
    ],
    "evasion_techniques": [
      "Injecting ad display hooks into legitimate browser processes",
      "Disguising binaries as media codecs or system helpers"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "f781bb49f8b15df726489312bcf8194ad9271649",
      "89312bcf8194ad9271649275819385920a19e48b"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ShyapeHelper"
    ],
    "file_paths": [
      "%AppData%\\Shyape\\shyape.exe",
      "%Temp%\\shyape_hook.dll"
    ]
  },
  "defensive_measures": [
    "Enable Potentially Unwanted Application (PUA) blocking in Windows Security",
    "Disable AutoRun/AutoPlay for removable storage media across enterprise endpoints",
    "Deploy endpoint behavioral monitoring to detect process injection into browser executables"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Adware:Win32/Shyape",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Shyape"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Adware:Win32/Shyape.A",
      "Trojan.scar/shyape"
    ]
  },
  "motivation": "Financial Crime & Pay-Per-Click Adware Syndication",
  "sample_hashes": []
}