{
  "family": "wowlik",
  "sample_count": 39,
  "category": "adware",
  "description": "Wowlik (cataloged across security vendors and threat intelligence databases under signatures including Adware:Win32/Wowlik, PUA:Win32/Wowlik, and Adware.Wowlik) is an aggressive adware and click-fraud botnet component active since 2016. Infiltrating endpoints primarily through third-party freeware download mirrors, pirated media players, and deceptive software wrappers, Wowlik installs persistent background services and modifies browser preferences. Once active, the adware injects unsolicited pop-up advertisements, overlays intrusive banners on legitimate web pages, alters default search providers, and silently generates artificial advertising clicks in hidden browser sessions to monetize victim web traffic across advertising syndication networks.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Adware:Win32/Wowlik",
    "PUA:Win32/Wowlik",
    "Adware.Wowlik",
    "Win32/Wowlik",
    "Adware:Win32/Wowlik.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Adware:Win32/Wowlik?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Wowlik is an adware and click-fraud family that injects unwanted ads and simulates ad clicks to generate revenue."
      }
    },
    {
      "@type": "Question",
      "name": "How does Wowlik infect Windows computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is commonly bundled inside free software downloads, third-party media players, and cracked application packages."
      }
    },
    {
      "@type": "Question",
      "name": "What browser changes are made by Wowlik?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies browser search parameters, installs unwanted browser extensions, and injects banners into webpages."
      }
    },
    {
      "@type": "Question",
      "name": "How does Wowlik perform click-fraud?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It opens hidden browser windows in the background to automatically click promotional links on affiliate ad networks."
      }
    },
    {
      "@type": "Question",
      "name": "How can users completely remove Wowlik?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall unfamiliar programs from Windows Settings, clean browser extensions, and run a Microsoft Defender scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1185",
    "T1176",
    "T1547.001",
    "T1071.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Freeware Bundlers",
    "Software Cracks & Keygens",
    "Pay-Per-Install Download Managers"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "In-Page Banner Ad Injection",
    "Automated Click-Fraud Simulation",
    "Search Query Redirection",
    "Browsing History Telemetry",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP GET beacons querying remote ad delivery networks for injected banner scripts",
      "Hidden HTTP requests executing automated clicks on sponsored advertisement URLs"
    ],
    "evasion_techniques": [
      "Disguising binaries as media tools or software helper utilities",
      "Spawning hidden, minimized browser worker processes for click fraud"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "48b3b42f2b3e449a57291dc8f781bb49f8b15df7",
      "726489312bcf8194ad9271649275819385920a19"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\WowlikService"
    ],
    "file_paths": [
      "%ProgramFiles%\\Wowlik\\wowlik.exe",
      "%AppData%\\Wowlik\\helper.dll"
    ]
  },
  "defensive_measures": [
    "Enable Potentially Unwanted Application (PUA) blocking in Windows Security",
    "Enforce enterprise browser extension management policies via GPO",
    "Block known adware syndication and click-fraud domains at enterprise firewalls"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Adware:Win32/Wowlik",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Wowlik"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Adware:Win32/Wowlik.A",
      "PUA:Win32/Wowlik!rfn"
    ]
  },
  "motivation": "Financial Crime & Pay-Per-Click Adware Syndication",
  "sample_hashes": []
}