Academy
TermMalware type

Greyware

Software that is not clearly malicious but behaves in unwanted ways: adware, trackers, unnecessary toolbars.

Flow

  1. 1Arrives in a bundle
  2. 2Changes settings
  3. 3Collects data or shows ads
Related families
—
MITRE ATT&CK
T1176 · Software Extensions
Sources
3 sources
01

Overview

Greyware usually arrives inside an installation, often with the user’s consent. It shows ads, collects browsing data or changes browser settings; this is why security products classify it separately as “potentially unwanted programs”. Malwarebytes

The risky part is that the same distribution channels are also used for infostealers: free software bundlers and ad networks. Malwarebytes

02

How it works

  1. 1

    Arrives in a bundle

    As a pre-checked option in the installation of a free program. Malwarebytes

  2. 2

    Changes settings

    The home page, search engine or extensions change. MITRE ATT&CK

  3. 3

    Collects data or shows ads

    Browsing habits are recorded and ads are injected. Malwarebytes

03

How to detect it

  • Browser extensions and search setting changes the user says they did not install. MITRE ATT&CK
04

What to do

  • Restrict software installation to the corporate software center; manage extensions with an allowlist. MITRE ATT&CK
05

MITRE ATT&CK

06

Related terms

07

Sources

  1. 1Software Extensions (T1176) · MITRE ATT&CK
  2. 2What is a PUP? · Malwarebytes
  3. 3What is adware? · Malwarebytes