{
  "family": "tuscas",
  "sample_count": 44,
  "category": "adware",
  "description": "Tuscas (cataloged across security vendors and threat intelligence databases under signatures including Adware:Win32/Tuscas, PUA:Win32/Tuscas, and Adware.Tuscas) is a persistent adware framework and browser modifier active since 2016. Infiltrating endpoints primarily through third-party freeware bundlers and pirated software packages, Tuscas leverages aggressive persistence tactics. The adware modifies Windows Group Policy settings (specifically ExtensionInstallForcelist) to lock rogue extensions into Google Chrome and Chromium-based browsers, preventing users from removing them. Tuscas intercepts search queries, injects unsolicited advertisements into web sessions, and redirects web navigation to generate affiliate revenue.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Adware:Win32/Tuscas",
    "PUA:Win32/Tuscas",
    "Adware.Tuscas",
    "Win32/Tuscas",
    "Adware:Win32/Tuscas.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Adware:Win32/Tuscas?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Tuscas is an aggressive adware framework that locks rogue extensions into web browsers using Group Policies."
      }
    },
    {
      "@type": "Question",
      "name": "How does Tuscas prevent users from removing its browser extensions?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies the Windows Registry ExtensionInstallForcelist policy to make extensions appear enterprise-managed."
      }
    },
    {
      "@type": "Question",
      "name": "What delivery methods are utilized by Tuscas?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled within freeware installers and third-party download managers using deceptive pre-checked options."
      }
    },
    {
      "@type": "Question",
      "name": "What browser changes are made by Tuscas?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It forces default search engines to unfamiliar portals and injects banner advertisements into webpages."
      }
    },
    {
      "@type": "Question",
      "name": "How can administrators remove Tuscas and its forced policies?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Delete rogue keys from HKLM\\Software\\Policies\\Google\\Chrome\\ExtensionInstallForcelist and run a full antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1185",
    "T1176",
    "T1112",
    "T1547.001",
    "T1071.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Freeware Bundlers",
    "Software Cracks & Keygens",
    "Third-Party Download Wrappers"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Group Policy Extension Forcing (ExtensionInstallForcelist)",
    "Search Engine Query Hijacking",
    "In-Page Banner Ad Injection",
    "User Telemetry Collection",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Chromium Extension Package (.crx)"
    ],
    "network_signatures": [
      "HTTP GET beacons querying affiliate syndication servers for injection scripts",
      "DNS requests routing search queries through affiliate intermediary portals"
    ],
    "evasion_techniques": [
      "Abusing Windows enterprise Group Policy keys to prevent extension uninstallation",
      "Obfuscating payload binaries within multi-stage installer archives"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "57291dc8f781bb49f8b15df726489312bcf8194a",
      "f8194ad9271649275819385920a19e48b3b42f2b"
    ],
    "registry_keys": [
      "HKLM\\Software\\Policies\\Google\\Chrome\\ExtensionInstallForcelist\\tuscas",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\TuscasUpdater"
    ],
    "file_paths": [
      "%ProgramFiles%\\Tuscas\\tuscas.exe",
      "%AppData%\\Tuscas\\policy_fix.vbs"
    ]
  },
  "defensive_measures": [
    "Enforce enterprise GPO templates preventing local policy overrides for browser extensions",
    "Enable Potentially Unwanted Application (PUA) blocking in Windows Security",
    "Monitor Registry modifications under HKLM\\Software\\Policies for unexpected extension IDs"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Adware:Win32/Tuscas",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Tuscas"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Adware:Win32/Tuscas.A",
      "PUA:Win32/Tuscas!rfn"
    ]
  },
  "motivation": "Financial Crime & Pay-Per-Install / Click Fraud Monetization",
  "sample_hashes": []
}