{
  "family": "ytddownloader",
  "sample_count": 23,
  "category": "pua",
  "description": "YTD Downloader (commonly cataloged across endpoint security vendors under signatures including PUA:Win32/YTDDownloader, SoftwareBundler:Win32/YTDVideoDownloader, and PUP.Optional.YTDDownloader) is a widely distributed potentially unwanted application (PUA) and software bundler marketed as a video downloading utility. Propagated through third-party download directories, aggressive search redirect ads, and misleading installation wrappers, YTD Downloader bundles extraneous commercial software components, browser modifiers, and adware plugins without explicit, clear user disclosure. Once deployed onto a Windows system, the program establishes persistence by configuring startup registry run keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and scheduling background maintenance tasks. It frequently generates disruptive pop-up advertisements prompting users to purchase commercial Pro licenses, injects affiliate links and banner advertisements into active browsing sessions, and may redirect default search queries to partner advertising portals.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "PUA:Win32/YTDDownloader",
    "SoftwareBundler:Win32/YTDVideoDownloader",
    "PUP.Optional.YTDDownloader",
    "Adware:Win32/YTDDownloader",
    "Win32/YTDVideoDownloader"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is PUA:Win32/YTDDownloader?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "YTD Downloader is a potentially unwanted program and software bundler that delivers unwanted adware, browser modifications, and aggressive upsell prompts."
      }
    },
    {
      "@type": "Question",
      "name": "How does YTD Downloader infiltrate Windows computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It enters primarily through deceptive third-party download portals, pay-per-install bundles, and fake video player update notices."
      }
    },
    {
      "@type": "Question",
      "name": "What system changes are made by YTD Downloader?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It adds automatic startup registry run keys, schedules background updater tasks, and installs supplementary browser extensions."
      }
    },
    {
      "@type": "Question",
      "name": "Does YTD Downloader pose privacy risks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, bundled components may monitor web browsing habits, search keywords, and visited URLs to serve targeted advertisements."
      }
    },
    {
      "@type": "Question",
      "name": "How can YTD Downloader and bundled components be removed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall the application via Windows Settings, remove unwanted extensions across installed browsers, and run an antimalware scan to purge lingering registry keys."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1189",
    "T1547.001",
    "T1053.005",
    "T1112",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - PUA:Win32/YTDDownloader",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/YTDDownloader"
    },
    {
      "name": "Malwarebytes Labs - PUP.Optional.YTDVideoDownloader Removal Guide",
      "url": "https://www.malwarebytes.com/blog/detections/pup-optional-ytdvideodownloader"
    },
    {
      "name": "Sophos Threat Center - YTDDownloader Analysis",
      "url": "https://www.sophos.com/en-us/threat-center/threat-analyses"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Terminate active YTD Downloader processes and background updater services via Task Manager.",
    "Uninstall YTD Video Downloader through Windows Settings or Programs and Features.",
    "Audit scheduled tasks and remove entries related to YTD background updates.",
    "Inspect installed extensions on Chrome, Edge, and Firefox and remove unauthorized add-ons.",
    "Execute an endpoint antimalware scan to purge residual registry keys and temporary adware installers."
  ],
  "what_to_avoid": [
    "Do not accept promotional upgrade offers or input payment credentials into the software interface.",
    "Do not install software packages from unverified third-party freeware repositories."
  ],
  "target_industries": [
    "Consumer Endpoints",
    "Educational Institutions",
    "Corporate Workstations"
  ],
  "target_geographies": [
    "Global"
  ],
  "threat_actors": [
    "Commercial Software Bundlers & Adware Affiliates"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Commercial Adware Monetization & Software Bundling",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}