{
  "family": "webdiscover",
  "sample_count": 3,
  "category": "advanced_threat",
  "description": "Adware:Win32/Webdiscover is a highly persistent, intrusive Potentially Unwanted Program (PUP) and **Browser Hijacker** that specifically manifests as an unremovable search bar anchored to the top of the Windows desktop. While it brands itself as a convenient Chromium-based search tool, its true purpose is to forcibly hijack user search traffic, inject advertisements, and generate illicit affiliate revenue for its creators.<br><br><b>Understanding Webdiscover</b><br>To an end-user, Webdiscover is extremely frustrating. It overlays a persistent search bar on the desktop that cannot be closed through normal UI methods, and it forcibly changes the default search engine in all installed browsers (Chrome, Edge, Firefox). For a security team, it represents a breakdown in endpoint hygiene and a vector for privacy violations, as every search query is logged and routed through adware tracking infrastructure.<br><br><b>Execution and Hijacking Mechanics</b><br>Webdiscover is heavily distributed via deceptive software bundles or fake updates (like fake Flash or Java installers) (`T1189`). Upon execution with administrative privileges (`T1204.002`), it establishes deep persistence. It installs a system service (`T1543.003`) and modifies the Registry Run keys (`T1547.001`) to ensure the desktop search bar launches immediately upon boot. It aggressively modifies browser configuration files, shortcut properties (`T1546`), and installs persistent browser extensions (`T1176`). To protect itself, Webdiscover often includes watchdog processes that actively monitor for attempts to uninstall it or revert browser settings, immediately reinstating the hijacked configuration if tampering is detected (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a degraded user experience, resource consumption, and privacy loss. Host-based IoCs include EDR alerts for the presence of the `WebDiscoverBrowser.exe` process, the creation of a 'WebDiscover' folder in `Program Files`, and unexpected modifications to browser shortcut targets (appending the adware's URL). Network IoCs include DNS queries resolving to the Webdiscover backend (often `search.webdiscoverbrowser.com` or similar tracking domains) and all web search traffic being forcibly redirected through affiliate links.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Webdiscover and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Webdiscover is classified as a Advanced Threat. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Webdiscover establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Webdiscover typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Webdiscover compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Webdiscover should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What lateral movement and credential access tactics does Webdiscover leverage in enterprise intrusions?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Webdiscover frequently utilizes privileged account harvesting techniques such as LSASS memory dumping, Kerberoasting, and token impersonation to escalate privileges. Once administrative credentials are acquired, it pivots across the victim network utilizing living-off-the-land binaries (LOLBins) such as WMI, PowerShell remoting, and PsExec, or abuses remote desktop protocols (RDP) to reach critical internal repositories and domain controllers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Webdiscover maintain covert communications and evade perimeter network monitoring?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Webdiscover often relies on multi-stage command and control (C2) architectures utilizing encrypted protocols over standard web ports (HTTPS/443 or DNS tunneling) to blend in with legitimate enterprise network traffic. Many variants incorporate proxy networks, domain fronting, or cloud services (such as Microsoft Graph API, Google Drive, or Telegram) to masquerade C2 channels, bypassing traditional signature-based egress filtering."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1562.001",
    "T1547.001",
    "T1176",
    "T1189"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions (Installing malicious toolbars/hijackers)",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Reverting browser setting changes)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Use Task Manager to locate and forcibly terminate all processes related to 'Webdiscover' before attempting uninstallation.",
    "Use the Windows Control Panel to uninstall the 'WebDiscover Browser' application.",
    "Inspect the properties of all browser shortcuts on the desktop and taskbar, and remove the Webdiscover URL from the 'Target' field.",
    "Reset all installed web browsers to their default settings and run a thorough scan with an enterprise-grade Adware/PUA removal tool to clean up remaining registry keys and extensions."
  ],
  "what_to_avoid": [
    "Do not simply try to hide the search bar or manually change the homepage; the watchdog service will immediately revert your changes.",
    "Avoid allowing users to download software from unverified third-party portals, as this is the primary vector for aggressive adware."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}