{
  "family": "websearch",
  "sample_count": 26,
  "category": "adware",
  "description": "WebSearch (cataloged across security intelligence feeds under signatures including BrowserModifier:Win32/WebSearch, Adware:Win32/WebSearch, and PUA:Win32/WebSearch) is an intrusive browser hijacker and search monetization framework active since 2012. Distributed through deceptive software bundlers, pirated software downloads, and fake Flash updates, WebSearch forcefully modifies browser configurations across Google Chrome, Mozilla Firefox, and Internet Explorer. It locks the browser homepage and default search provider to affiliated advertising search engines, displays persistent sponsored pop-under advertisements, and injects commercial hyperlinks into organic search results. WebSearch establishes persistent autostart services and scheduled tasks to prevent victims from reverting browser settings.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "BrowserModifier:Win32/WebSearch",
    "Adware:Win32/WebSearch",
    "PUA:Win32/WebSearch",
    "Win32/WebSearch",
    "WebSearch Hijacker"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is BrowserModifier:Win32/WebSearch?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "WebSearch is an invasive browser hijacker that alters default search providers and homepages to monetize web traffic."
      }
    },
    {
      "@type": "Question",
      "name": "How does WebSearch get onto Windows computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled with third-party software installers, fake browser updates, and downloads from torrent networks."
      }
    },
    {
      "@type": "Question",
      "name": "What changes does WebSearch make to browsers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It replaces default search engines, changes the startup homepage, and injects sponsored advertisement banners."
      }
    },
    {
      "@type": "Question",
      "name": "How does WebSearch prevent removal?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It registers background watchdog services and modifies desktop .lnk shortcuts to restore hijacked settings automatically."
      }
    },
    {
      "@type": "Question",
      "name": "How do you completely remove WebSearch?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall rogue entries via Windows Settings, reset browser configurations to default, and run a full scan with Microsoft Defender."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1176",
    "T1059.007",
    "T1112",
    "T1071.001",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2012,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Software Bundlers",
    "Fake Flash Player Updates",
    "Torrent Download Portals"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Browser Homepage & Search Engine Hijacking",
    "In-Page Banner & Hyperlink Ad Injection",
    "Browser Desktop Shortcut Modification (.lnk)",
    "User Search Telemetry Collection",
    "Watchdog Service Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Service/Toolbar)",
      "Browser Extension Module (JSON/JS)"
    ],
    "network_signatures": [
      "HTTP/HTTPS GET queries directing search traffic through affiliate tracking intermediate domains",
      "Periodic telemetry beacons transmitting host GUID and installation metrics"
    ],
    "evasion_techniques": [
      "Appending tracking URLs to browser desktop shortcuts to evade simple extension removal",
      "Running background watchdog processes to restore hijacked registry settings if modified"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "15b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5",
      "26c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\WebSearchService",
      "HKCU\\Software\\WebSearch"
    ],
    "file_paths": [
      "%ProgramFiles%\\WebSearch\\websearch.exe",
      "%AppData%\\WebSearch\\config.ini",
      "%LocalAppdata%\\Temp\\ws_installer.tmp"
    ]
  },
  "defensive_measures": [
    "Enable Potentially Unwanted Application (PUA) blocking in Microsoft Defender",
    "Inspect desktop .lnk shortcuts for unauthorized appended URL parameters",
    "Block unprivileged users from installing browser extensions via Group Policy"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - BrowserModifier:Win32/WebSearch",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=BrowserModifier:Win32/WebSearch"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Adware.Win32.WebSearch",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "BrowserModifier:Win32/WebSearch.A",
      "Adware:Win32/WebSearch.gen"
    ]
  },
  "motivation": "Advertising Monetization, Search Hijacking & Telemetry Collection",
  "sample_hashes": []
}