{
  "family": "toggle",
  "sample_count": 20,
  "category": "adware",
  "description": "Toggle (identified across endpoint security vendors as BrowserModifier:Win32/Toggle, Adware:Win32/Toggle, and PUA:Win32/Toggle) is a deceptive adware toolbar and browser modifier framework. Distributed through third-party software installers, free utility downloads, and fake media codecs, Toggle modifies installed browser configurations across Chrome, Firefox, and Edge. It forcibly alters default search providers, start pages, and new tab URLs to redirect queries through affiliated advertising and monetization portals. Toggle injects intrusive banner ads, floating hyperlinks, and pop-up windows into visited web pages. It establishes persistence by configuring startup registry run keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and registers background scheduled updater tasks, constantly collecting browsing navigation and search query telemetry.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "BrowserModifier:Win32/Toggle",
    "Adware:Win32/Toggle",
    "PUA:Win32/Toggle",
    "Toolbar:Win32/Toggle",
    "Win32/Toggle"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is BrowserModifier:Win32/Toggle?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Toggle is an adware toolbar and browser modifier that changes browser search settings to display affiliate ads."
      }
    },
    {
      "@type": "Question",
      "name": "How does Toggle enter computer systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It enters bundled within freeware installers, third-party download wrappers, and counterfeit software patches."
      }
    },
    {
      "@type": "Question",
      "name": "What browser modifications are made by Toggle?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It overrides the default search engine, homepage, and new tab pages, while injecting commercial pop-ups into web pages."
      }
    },
    {
      "@type": "Question",
      "name": "Does Toggle compromise user privacy?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, it tracks web browsing navigation, search queries, and clicked links to deliver targeted behavioral advertisements."
      }
    },
    {
      "@type": "Question",
      "name": "How can Toggle be completely removed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall via Windows Settings, remove rogue extensions across browsers, reset browser configurations, and run an antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1189",
    "T1112",
    "T1547.001",
    "T1056.001",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - BrowserModifier:Win32/Toggle",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=BrowserModifier:Win32/Toggle"
    },
    {
      "name": "Malwarebytes Labs - Adware.Toggle Removal Guide",
      "url": "https://www.malwarebytes.com/blog/detections/adware-toggle"
    },
    {
      "name": "Sophos Threat Center - Toggle Analysis",
      "url": "https://www.sophos.com/en-us/threat-center/threat-analyses"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Terminate active browser processes and associated toolbar helper applications.",
    "Uninstall Toggle via Windows Programs and Features / Settings.",
    "Remove rogue Toggle extensions and add-ons across Chrome, Firefox, and Edge.",
    "Reset browser default search engine and home page configurations.",
    "Run an updated antimalware scan to purge persistent registry keys and adware tracking modules."
  ],
  "what_to_avoid": [
    "Do not click on sponsored search links or promotional banners injected into websites.",
    "Do not accept default bundle checkboxes during third-party freeware installations."
  ],
  "target_industries": [
    "Consumer Endpoints",
    "Enterprise Workstations"
  ],
  "target_geographies": [
    "Global"
  ],
  "threat_actors": [
    "Commercial Software Monetization Networks & Adware Syndicates"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "collection"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Search Traffic Monetization & Affiliate Advertising",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}