Bundling: the dominant entry route. Download portals and fake installers wrap the desired program in a 'wrapper' that chains pre-ticked offers; every checkbox the user fails to untick is a paid install for the distributor. The business model is called pay-per-install (PPI).
What is adware?
Adware is software that displays unwanted advertising —pop-ups, banners, ads injected into the browser— and typically collects browsing data to monetise it. It almost always arrives "bundled" inside installers for free programs, and it lives on the border between the PUP/PUA (potentially unwanted program, with consent buried in the fine print) and outright malware. In a corporate environment it is not a mere annoyance: it is your employees' telemetry flowing to third parties and, quite often, the door through which something worse eventually walks in.
Why does it matter?
For three reasons that tend to be underestimated. The first is privacy: adware profiles users' browsing —searches, sites visited, sometimes form data— and sells it to intermediaries; on company devices that means information about customers, suppliers and projects flowing to data brokers with no contract covering it, a direct GDPR and confidentiality problem. The second is the blurry line with malware: the same pay-per-install schemes that distribute adware also distribute loaders, spyware and infostealers; families like Fireball and the aggressive toolbar bundlers proved that the operator injecting ads today will install whatever pays tomorrow. And the third is what it reveals: a fleet with adware on it is a fleet where users install software unchecked, with local admin rights and no allowlisting — precisely the conditions a serious attacker needs. Treating it as a minor incident wastes the cheapest early-warning signal you will ever get about the real security posture of your workstations.
Key points
The PUP/PUA vs malware border: "legal" adware displays formal consent in the fine print; it crosses the line when it resists uninstallation, injects itself into other processes or encrypts its traffic to hide what it exfiltrates. Antivirus products classify it as PUA and many do NOT block it by default: you have to switch that on.
Browser hijackers and extensions: today's most common variant. They change the search engine and home page, inject results and ads, and read history. Legitimate extensions with thousands of users have been bought and turned into adware through a single automatic update.
Privacy and compliance risk: employee browsing data sold to third parties is a confidentiality incident, not an annoyance. If the devices handle personal or customer data, exfiltration via adware lands squarely in GDPR territory.
Gateway to bigger malware: PPI networks do not discriminate between payloads. Adware campaigns have been used to deploy loaders that later install infostealers or stage ransomware. An endpoint that keeps accumulating adware is an endpoint that regularly runs strangers' code.
Clean-up and prevention: remove unrecognised programs and extensions, reset the browser, and check local proxy and DNS settings; to keep it from returning, application allowlisting (AppLocker/WDAC), no local admin for users, an approved software catalogue, and PUA detection enabled in the antivirus/EDR.
Example: From freeware with a surprise to an infostealer at an SMB
At a small company with no installation policies, an office worker downloads a file compressor from a download portal. The installer adds two pre-ticked "offers": a browser toolbar and a so-called system optimiser. Within weeks the browser has a different default search engine, results carry injected ads and the machine is noticeably slower. Nobody reports it because "it's just advertising". The optimiser, meanwhile, pulls updates from a server that also distributes payloads for a pay-per-install network; one of them is a loader that installs an infostealer, and the credentials for the corporate mailbox end up for sale.
A serious response works on two levels. The immediate one: inventory and clean the affected machines (programs, extensions, scheduled tasks, proxy and DNS), reset the browsers and rotate the credentials stored in them. The structural one: remove local admin from users, publish an approved software catalogue backed by an internal repository, apply allowlisting with AppLocker or WDAC as part of workstation hardening, and enable PUA detection in the EDR so the next "offer" never gets to run. Adware disappears as a category the moment installing software stops being each employee's individual decision.
Common mistakes
- Treating it as a cosmetic nuisance rather than an incident: if there is adware, there is an uncontrolled code-execution channel on that machine and browsing data flowing to third parties. It deserves a ticket, analysis and a root cause, not just a quick clean-up.
- Leaving users with local admin and no software catalogue: as long as anyone can install anything, the clean-up is temporary. The adware will be back with the next 'free' download.
- Installing with 'Next-Next-Finish': bundled offers come pre-ticked and count on the user's haste. Training staff to use custom installation and to download only from the vendor's official site removes most of the problem.
- Ignoring browser extensions: the usual blind spot. Review them periodically, manage them by policy (enforce an allowed-extensions list from the browser's admin console) and be wary of extensions that change owners.
- Not enabling PUA/PUP detection in the antivirus or EDR: many products ship with it off or in audit-only mode by default to avoid false positives, so adware sails through clean. It is a configuration checkbox, not an investment.
Related services
This concept may be related to services such as:
Frequently asked questions
Is adware illegal or just annoying? Should I treat it as a security incident?
It depends on where it sits on the scale. "Commercial" adware hides behind formal consent (the pre-ticked box nobody reads) and is rarely prosecutable; adware that resists uninstallation, injects traffic or exfiltrates data without consent is malware for all practical purposes. Inside a company, the legal distinction matters less than the operational one: either way, unauthorised code is running and browsing data is leaving for third parties — so yes, treat it as an incident, with an inventory of what got installed, an assessment of what data it may have collected, and a root cause explaining how it got in, because something far worse can arrive through the exact same route.
How do I stop my employees installing adware if I have no IT team?
With three measures that do not require a department: first, remove local administrator rights — without them, most bundlers simply cannot install; second, agree on a short list of approved software and the rule of always downloading from the vendor's official site, never from download portals; and third, turn on the protection against potentially unwanted applications that Windows (SmartScreen/Defender) and modern browsers include but sometimes ship disabled. A short awareness session on installers with pre-ticked boxes completes the picture. If you would rather delegate it, a cybersecurity for SMBs service can leave these policies configured and monitored.
How do I clean a machine full of adware without reinstalling Windows?
Methodically, because modern adware anchors itself in several places at once. The practical order: uninstall unrecognised programs from the apps panel; review and remove browser extensions, then reset the search engine and home page; check scheduled tasks, startup items and the proxy and DNS settings (hijackers modify them to keep injecting ads); and finally run a scan with PUA detection enabled. Rotate the passwords saved in that browser too, just in case. If the behaviour persists after all that, or the machine handles sensitive information, a clean reinstall is cheaper than the doubt — and consider an EDR-based analysis before restoring anything.
Why doesn't my antivirus block adware?
Because much of it is technically classified not as malware but as PUA/PUP (potentially unwanted applications): it carries formal consent and a digital signature, and antivirus vendors have been sued for flagging it as malicious. As a result, most products keep that category separate and leave it disabled or in warn-only mode by default. The fix is to enable it explicitly: in Microsoft Defender it is called "potentially unwanted app blocking", and most corporate EDR platforms have an equivalent policy. Combined with application allowlisting, adware simply stops executing — no need to chase it machine by machine.