Adware

Introduction

Adware (advertising-supported software) displays unwanted advertisements, redirects searches, and tracks browsing behaviour to generate revenue. While sometimes “legitimate” (bundled with free software), aggressive adware crosses into malware territory by hijacking browsers, injecting ads, and collecting data without consent.

History

Milestone	Year	Details
Early adware	Late 1990s	Ad-supported free software
Gator/eZula	2000s	Controversial bundling; Claria Corp
Browser toolbars	2000s	Ask, Yahoo, Conduit toolbars
Mac adware	2010s+	MacKeeper, Genieo, InstallCore
Mobile adware	2010s+	SDK abuse in free apps

How It Works

1. INSTALLATION
   └─ Bundled with free software, fake updates, drive-by

2. BROWSER HIJACKING
   └─ Change homepage, search engine, new tab page

3. AD INJECTION
   └─ Inject ads into web pages (not from original site)

4. TRACKING
   └─ Monitor searches, clicks, browsing history

3. DATA MONETISATION
   └─ Sell browsing profiles to ad networks

Notable Examples

Adware	Platform	Behaviour
Gator/Claria	Windows	Pop-ups, tracking
Conduit Toolbar	Windows	Search hijack
MacKeeper	macOS	Fake “cleaner”, aggressive
Genieo	macOS	Search redirect
InstallCore	Windows	Bundler, silent installs
Fireball	Windows/macOS	Browser hijacker; 250M+

Prevention

✅ Custom install — uncheck bundled offers
✅ Download from official sites only
✅ Ad blocker (uBlock Origin) + privacy extensions
✅ Anti-malware with PUA/PUP detection
✅ Regular browser reset / profile clean
✅ Avoid “free” system optimisers / cleaners

MITRE ATT&CK

Technique	ID	Description
Browser Extensions	T1176	Malicious extensions
Modify Browser Settings	T1658	Homepage/search changes
Data from Local System	T1005	Browsing history collection

Spyware — Covert tracking
Mobile Malware — Ad SDK abuse