London Daily

Focus on the big picture.
Friday, Jun 20, 2025

Microsoft Warns 'Adrozek' Malware is Infecting Thousands of PCs to Insert Ads

Microsoft Warns 'Adrozek' Malware is Infecting Thousands of PCs to Insert Ads

'We recorded hundreds of thousands of encounters of the Adrozek malware across the globe, with heavy concentration in Europe and in South Asia and Southeast Asia,' Microsoft said.

A new malware strain has been spreading to hundreds of thousands of Windows PCs in an effort to inject unauthorized ads into users’ search results, according to Microsoft.

The company has been tracking "Adrozek," a malware family capable of modifying multiple browsers including Google’s Chrome, Microsoft’s Edge and Mozilla’s Firefox in order to insert the ads into search result pages.

“At its peak in August, the threat was observed on over 30,000 devices every day,” Microsoft warned in a blog post on Thursday.

Inserting the ads into your search results is certainly annoying. But the real threat is how the malware can also steal login credentials from the Firefox browser, and potentially give hackers a launching pad for more damaging crimes.

Adrozek works by modifying a browser’s Dynamic Link Libraries or DLL files to change the settings, including turning off the security safeguards and the automatic updates. The result can place links to ads alongside legitimate ads, as the example below shows.



“The intended effect is for users, searching for certain keywords, to inadvertently click on these malware-inserted ads, which lead to affiliated pages,” Microsoft said. “The attackers earn through affiliate advertising programs, which pay by amount of traffic referred to sponsored affiliated pages.”

To deliver the malware, the hackers have been resorting to drive-by downloads. This can occur when a user clicks on a malicious link or visits a website that’s been tampered with. The PC will trigger the malware to download, which can sometimes install itself on the computer by exploiting a software vulnerability.

Hence, it’s a good idea to always keep your browser up to date. In other cases, the user will install the malware from a drive-by download, believing it to be a safe program.



In this case, Adrozek will drop an .exe file in the PC’s “temp” folder. The .exe file will then deliver the main malware payload in the “Programs Files” folder using a file name such as “Audiolava.exe, QuickAudio.exe, and converter.exe,” Microsoft said.

The company tracked Adrozek’s distribution to 159 unique domains, which hosted tens of thousands of URLs to try and spread the malware.

“In total, from May to September 2020, we recorded hundreds of thousands of encounters of the Adrozek malware across the globe, with heavy concentration in Europe and in South Asia and Southeast Asia,” Microsoft added. “As this campaign is ongoing, this infrastructure is bound to expand even further.



Although the malware is so far aimed at inserting unauthorized ads, Microsoft is concerned Adrozek could one day be used for more malicious crimes, such as redirecting users to scam websites. The good news is that the company’s built-in Windows Defender antivirus can detect and block Adrozek.

“End users who find this threat on their devices are advised to re-install their browsers,” the company added.


Newsletter

Related Articles

0:00
0:00
Close
16 Billion Login Credentials Leaked in Unprecedented Cybersecurity Breach
Senate hearing on who was 'really running' Biden White House kicks off
Iranian Military Officers Reportedly Seek Contact with Reza Pahlavi, Signal Intent to Defect
FBI and Senate Investigate Allegations of Chinese Plot to Influence the 2020 Election in Biden’s Favor Using Fake U.S. Driver’s Licenses
Vietnam Emerges as Luxury Yacht Destination for Ultra‑Rich
Plans to Sell Dutch Embassy in Bangkok Face Local Opposition
China's Iranian Oil Imports Face Disruption Amid Escalating Middle East Tensions
Trump's $5 Million 'Trump Card' Visa Program Draws Nearly 70,000 Applicants
DGCA Finds No Major Safety Concerns in Air India's Boeing 787 Fleet
Airlines Reroute Flights Amid Expanding Middle East Conflict Zones
Elon Musk's xAI Seeks $9.3 Billion in Funding Amid AI Expansion
Trump Demands Iran's Unconditional Surrender Amid Escalating Conflict
Israeli Airstrike Targets Iranian State TV in Central Tehran
President Trump is leaving the G7 summit early and has ordered the National Security Council to the Situation Room
Taiwan Imposes Export Ban on Chips to Huawei and SMIC
Israel has just announced plans to strike Tehran again, and in response, Trump has urged people to evacuate
Netanyahu Signals Potential Regime Change in Iran
Juncker Criticizes EU Inaction on Trump Tariffs
EU Proposes Ban on New Russian Gas Contracts
Analysts Warn Iran May Resort to Unconventional Warfare
Iranian Regime Faces Existential Threat Amid Conflict
Energy Infrastructure Becomes War Zone in Middle East
UK Home Secretary Apologizes Over Child Grooming Failures
Trump Organization Launches 5G Mobile Network and Golden Handset
Towcester Hosts 2025 English Greyhound Derby Amid Industry Scrutiny
Gary Oldman and David Beckham Knighted in King's Birthday Honours
Over 30,000 Lightning Strikes Recorded Across UK During Overnight Storms
Princess of Wales Returns to Public Duties at Trooping the Colour
Red Arrows Use Sustainable Fuel in Historic Trooping the Colour Flypast
Former Welsh First Minister Addresses Unionist Concerns Over Irish Language
Iran Signals Openness to Nuclear Negotiations Amid Ongoing Regional Tensions
France Bars Israeli Arms Companies from Paris Defense Expo
King Charles Leads Tribute to Air India Crash Victims at Trooping the Colour
Jack Pitchford Embarks on 200-Mile Walk to Support Stem Cell Charity
Surrey Hikers Take on Challenge of Climbing 11 Peaks in a Single Day
UK Deploys RAF Jets to Middle East Amid Israel-Iran Tensions
Two Skydivers Die in 'Tragic Accident' at Devon Airfield
Sainsbury's and Morrisons Accused of Displaying Prohibited Tobacco Ads
UK Launches National Inquiry into Grooming Gangs
Families Seek Closure After Air India Crash
Gold Emerges as Global Safe Haven Amid Uncertainty
Trump Reports $57 Million Earnings from Crypto Venture
Trump's Military Parade Sparks Concerns Over Authoritarianism
Nationwide 'No Kings' Protests Challenge Trump's Leadership
UK Deploys Jets to Middle East Amid Rising Tensions
Trump's Anti-War Stance Tested Amid Israel-Iran Conflict
Germany Holds First Veterans Celebration Since WWII
U.S. Health Secretary Dismisses CDC Vaccine Advisory Committee
Minnesota Lawmaker Melissa Hortman and Husband Killed in Targeted Attack; Senator John Hoffman and Wife Injured
Exiled Iranian Prince Reza Pahlavi Urges Overthrow of Khamenei Regime
×