{
  "family": "unwaders",
  "sample_count": 111,
  "category": "adware",
  "description": "Unwaders (identified by Microsoft Defender as Adware:Win32/Unwaders, PUA:Win32/Unwaders, and Misleading:Win32/Unwaders) is a deceptive adware monetization framework and Potentially Unwanted Application (PUA) family active since 2015. Operating across Windows environments, Unwaders is primarily distributed through Pay-Per-Install (PPI) wrapper networks, bundled with third-party software repackages, game cracks, and utility toolbars. Once installed on a victim machine, Unwaders establishes deep persistence via Registry Run keys and hidden background services. It modifies shortcut (.LNK) targets across the desktop and Start Menu, appending unwanted search engine URLs and advertising parameters so that opening Google Chrome, Mozilla Firefox, or Microsoft Edge automatically redirects the browser through monetizeable affiliate portals. Furthermore, Unwaders installs rogue browser extensions, monitors web traffic, and injects unsolicited banner advertisements and sponsored hyperlinks directly into visited webpages, degrading network bandwidth and compromising user browsing privacy.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Adware:Win32/Unwaders",
    "PUA:Win32/Unwaders",
    "Misleading:Win32/Unwaders",
    "Adware.Unwaders",
    "Program:Win32/Unwaders.A!ml"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Adware:Win32/Unwaders?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Unwaders is an adware and PUA family that hijacks web browsers, modifies desktop shortcuts, and displays unwanted ads to monetize traffic."
      }
    },
    {
      "@type": "Question",
      "name": "How does Unwaders redirect browser searches?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies Windows shortcut (.LNK) command arguments to force web browsers to launch affiliated advertising landing pages."
      }
    },
    {
      "@type": "Question",
      "name": "How does Unwaders enter user systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled inside deceptive third-party installers, freeware downloads, and cracked software packages."
      }
    },
    {
      "@type": "Question",
      "name": "Can Unwaders persist after standard browser uninstallation?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, it creates persistent registry run entries and background watchdog tasks that reinstall dropped extensions upon system reboot."
      }
    },
    {
      "@type": "Question",
      "name": "How can Unwaders be fully removed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Run a comprehensive antimalware scan, reset web browser configurations to defaults, and restore original shortcut target paths."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1189",
    "T1176",
    "T1112",
    "T1562.001",
    "T1105",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint or disconnect network access temporarily to prevent secondary adware bundle downloads.",
    "Deploy endpoint security tools (such as Malwarebytes or Microsoft Defender) to quarantine dropped binary components.",
    "Audit all browser shortcuts (.LNK files) on the Desktop and Start Menu, removing appended affiliate URL arguments.",
    "Reset browser profiles and remove unauthorized extensions across Chrome, Edge, and Firefox."
  ],
  "what_to_avoid": [
    "Do not rely solely on built-in software uninstaller entries, as adware often leaves persistence watchdogs behind.",
    "Avoid clicking on deceptive search redirect warnings or fake 'system alert' banners injected by the adware."
  ],
  "target_industries": [
    "Global / Opportunistic",
    "Consumer Endpoints",
    "Commercial Workstations"
  ],
  "motivation": "Adware Revenue",
  "threat_actors": [
    "Unknown / Cybercriminal",
    "Deceptive PPI Affiliates"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "defense_evasion"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2015,
  "lineage": {
    "derived_from": [
      "Deceptive PPI Bundlers"
    ],
    "variants": [
      "Unwaders.A",
      "Unwaders.C!rfn",
      "Unwaders.A!ml"
    ]
  },
  "iocs": {
    "file_hashes": [
      "9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b",
      "0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b"
    ],
    "delivery": [
      "Pay-Per-Install software bundlers and deceptive repackaged utilities",
      "Malicious advertising redirects and drive-by downloads"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\UnwadersLaunch",
      "Browser shortcut (.LNK) target argument modification"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Misleading:Win32/Unwaders",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Misleading:Win32/Unwaders"
    },
    {
      "name": "Microsoft Defender Threat Encyclopedia - Adware:Win32/Unwaders",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Unwaders"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}