{
  "family": "yobrowser",
  "sample_count": 90,
  "category": "adware",
  "description": "YoBrowser (identified in security telemetry under detections including PUA:Win32/YoBrowser, Trojan:Win32/YoBrowser, and Adware:Win32/YoBrowser) is a deceptive web browser clone and adware distribution framework active since 2018. Packaged as a customized Chromium-based application promising enhanced privacy and browsing speed, YoBrowser is distributed via pay-per-install bundlers, cracked software portals, and deceptive full-screen 'Update Recommended' notifications. Once installed, YoBrowser aggressively overwrites Windows file type associations (.html, .htm, .pdf) and URL protocol handlers (http, https) to force itself as the system default web browser. In doing so, it locks user search queries to sponsored revenue-sharing search gateways, forces pre-loaded commercial bookmarks into the toolbar, and injects unclosable interstitial pop-ups and floating display advertisements into arbitrary browsing sessions. YoBrowser also monitors user web browsing activity and transmits search history to remote advertising servers.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "PUA:Win32/YoBrowser",
    "Trojan:Win32/YoBrowser",
    "Adware:Win32/YoBrowser",
    "YoBrowser"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is PUA:Win32/YoBrowser?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "YoBrowser is an adware application and browser clone that hijacks default browser associations and serves intrusive advertisements."
      }
    },
    {
      "@type": "Question",
      "name": "How does YoBrowser become installed on a computer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is typically bundled into third-party software installers, torrent downloads, and fake software update pop-ups."
      }
    },
    {
      "@type": "Question",
      "name": "What changes does YoBrowser make to Windows default programs?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It silently registers itself as the default handler for HTML files, PDFs, and HTTP/HTTPS web protocols."
      }
    },
    {
      "@type": "Question",
      "name": "Does YoBrowser collect sensitive web browsing telemetry?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, it logs visited URLs, search queries, IP addresses, and browsing habits to monetize user traffic."
      }
    },
    {
      "@type": "Question",
      "name": "How can users uninstall and remove YoBrowser?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall YoBrowser via Windows Apps & Features, reset default browser associations to Chrome/Edge, and perform an antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.002",
    "T1189",
    "T1547.001",
    "T1176",
    "T1059.003",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the active exfiltration of browsing telemetry and the downloading of further adware modules.",
    "Audit the 'Add/Remove Programs' list and manually uninstall the Yobrowser application and any bundled software.",
    "Deploy an enterprise-grade adware removal tool (e.g., AdwCleaner) to locate and strip the deep registry hooks and restore file associations.",
    "Reset the default Windows file associations (Default Apps) to ensure `http`/`https` protocols are routed back to a sanctioned, secure browser."
  ],
  "what_to_avoid": [
    "Do not allow users to log into any corporate portals using Yobrowser, as it actively intercepts and records all entered data.",
    "Avoid ignoring the infection; adware tracking data is highly detailed and may expose corporate activities to third-party brokers."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Adware Revenue",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2018,
  "threat_actor": null,
  "delivery_mechanism": [
    "Software Bundlers",
    "Deceptive Online Video Converters",
    "Fake Browser Update Prompts"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Default Browser Hijacking",
    "Ad Injection",
    "Search Engine Redirection",
    "Telemetry Collection",
    "Sponsored Bookmark Injection"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 EXE",
      "Chromium Framework Files",
      "Browser Extension"
    ],
    "network_signatures": [
      "HTTP search query redirects to syndicated monetization domains",
      "Telemetry beacons reporting host browsing patterns"
    ],
    "evasion_techniques": [
      "Legitimate Chromium source code compilation",
      "Silent installer flags bundled in freeware wrappers"
    ],
    "persistence_mechanisms": [
      "Windows default application protocol registry overrides",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\YoBrowser"
    ]
  },
  "impact": {
    "confidentiality": "Low",
    "integrity": "Medium",
    "availability": "Low",
    "scope": "Default browser settings, web search privacy, system performance"
  },
  "lineage": {
    "derived_from": [
      "Rogue Chromium Browser Bundlers"
    ],
    "variants": [
      "YoBrowser.A",
      "YoBrowser.B"
    ]
  },
  "iocs": {
    "file_hashes": [
      "e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6",
      "b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3"
    ],
    "delivery": [
      "yobrowser_installer.exe",
      "browser_setup.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\YoBrowserUpdater",
      "C:\\Program Files (x86)\\YoBrowser\\Application\\yobrowser.exe"
    ]
  },
  "sources": [
    {
      "name": "Malwarebytes Labs Threat Encyclopedia - PUA.YoBrowser",
      "url": "https://www.malwarebytes.com/threats/yobrowser"
    },
    {
      "name": "Microsoft Defender Security Intelligence - PUA:Win32/YoBrowser",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/YoBrowser"
    }
  ]
}