{
  "family": "zylom",
  "sample_count": 19,
  "category": "adware",
  "description": "Zylom (cataloged across security vendors under designations including Adware:Win32/Zylom, BrowserModifier:Win32/Zylom, and PUA:Win32/Zylom) is a widely distributed adware framework, browser modifier, and deceptive game installer helper active since the mid-2000s. Bundled with casual downloadable desktop games, media utilities, and freeware installers, Zylom installs persistent background updater utilities and browser toolbars without prominent user disclosure. The software hijacks default web browser settings in Internet Explorer, Google Chrome, and Mozilla Firefox, changing default homepages, search engines, and new tab destinations to ad-supported monetization domains. Zylom monitors user browsing habits, capturing search queries and visited URLs to inject contextual banner advertisements, pop-under windows, and sponsored affiliate links into web pages. It establishes autostart persistence via Windows registry Run entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and registers background Windows services to ensure the adware persists across system reboots.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Adware:Win32/Zylom",
    "BrowserModifier:Win32/Zylom",
    "PUA:Win32/Zylom",
    "Win32/Zylom",
    "Zylom Games Toolbar",
    "Adware.Zylom"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Adware:Win32/Zylom?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Zylom is an adware program and browser modifier bundled with casual games that redirects searches and injects advertisements."
      }
    },
    {
      "@type": "Question",
      "name": "How does Zylom modify web browser configurations?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It alters homepage, new tab, and default search engine settings to route searches through advertising monetization partner portals."
      }
    },
    {
      "@type": "Question",
      "name": "How does Zylom get installed on computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled with third-party software installers, free casual game packages, and freeware download portals."
      }
    },
    {
      "@type": "Question",
      "name": "Does Zylom collect personal user data?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It tracks search queries, visited website URLs, and basic system configuration details to deliver targeted advertisements."
      }
    },
    {
      "@type": "Question",
      "name": "How can Zylom adware be removed from a system?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall the application via Windows Installed Apps, reset browser search and homepage settings, and run a reputable antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1176",
    "T1547.001",
    "T1082",
    "T1071.001",
    "T1217"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2005,
  "threat_actor": null,
  "delivery_mechanism": [
    "Bundled Software Installers",
    "Casual Game Download Aggregators",
    "Deceptive Online Game Portals"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Browser Homepage & Search Engine Redirection",
    "Contextual Ad Injection (Pop-ups, Sponsored Links)",
    "User Search Telemetry & Browsing Keyword Tracking",
    "Autostart Registry Run Key Persistence",
    "Background Service Registration"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Browser Helper Object (BHO DLL)",
      "Browser Extension Package"
    ],
    "network_signatures": [
      "HTTP GET requests redirecting search keywords to monetization affiliate feeds",
      "Outbound telemetry beacons reporting client installation identifiers and system locale"
    ],
    "evasion_techniques": [
      "Obfuscating toolbar components inside legitimate-appearing game installation directories",
      "Silently reinstalling browser modifications upon user reboot via background services"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "e5f60718293a4b5c6d7e8f9a0b1c2d3e4f5a6b7c",
      "f60718293a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ZylomGamesPlayer",
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\ZylomGames"
    ],
    "file_paths": [
      "%ProgramFiles%\\Zylom Games\\zylom.exe",
      "%AppData%\\Zylom\\updater.exe"
    ]
  },
  "defensive_measures": [
    "Configure group policies to block unauthorized installation of browser extensions and helper objects",
    "Enable Potentially Unwanted Application (PUA) blocking in Windows Defender Antivirus",
    "Educate users to avoid downloading bundled freeware installers from unverified third-party websites"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Adware:Win32/Zylom",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Zylom"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - PUA.Win32.Zylom",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Adware:Win32/Zylom.A",
      "BrowserModifier:Win32/Zylom.B"
    ]
  },
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "collection"
  ],
  "ecosystem": [
    "windows_pe",
    "browser_extension"
  ],
  "is_emerging": false,
  "motivation": "Advertising Revenue, Search Monetization & Tracking",
  "sample_hashes": []
}