Anatomy of a Scamware Network—MultiPlug

**Executive summary:** Zscaler researchers uncovered a large-scale MultiPlug scamware campaign that uses search-poisoning lures and signed installers to distribute adware/spyware; the campaign uses 33 Certum/Unizeto code-signing certificates to sign 2,783 binaries hosted across 447 hosts (323 domains), achieves persistence (service 'compfix'), installs modified Chrome DLLs and browser add-ons that resist removal, and exfiltrates system data via HTTP POST — enterprises should treat even seemingly benign adware as a security risk due to its persistence and payload delivery capabilities.