Globalcret.azurewebsites.net is a browser hijacker that redirects your searches and homepage through a malicious domain hosted on Microsoft Azure's cloud infrastructure. While it masquerades as a legitimate search service, this hijacker exists solely to generate fraudulent advertising revenue by forcing your browser through a chain of redirects before landing on affiliate search pages or potentially dangerous websites. Users typically encounter this threat after installing freeware bundles or clicking deceptive "update" prompts, and once installed, it proves remarkably stubborn to remove through conventional means.
This hijacker doesn't just change your homepage—it modifies browser settings at multiple levels, installs persistence mechanisms that restore itself after removal attempts, and may collect your browsing data to build advertising profiles. The Azure hosting gives it a veneer of legitimacy that helps it evade some security filters, but make no mistake: this is unwanted software that compromises your browser's integrity and your privacy.
Threat Profile
| Attribute | Details |
|---|---|
| Threat Family | Browser Hijacker / Potentially Unwanted Program (PUP) |
| Primary Alias | Globalcret redirect, Azure redirect virus |
| Affected Platforms | Windows 7/8/8.1/10/11; Chrome, Firefox, Edge primarily |
| Distribution Method | Software bundling, fake updates, deceptive installers |
| Persistence Mechanisms | Browser extension policies, scheduled tasks, registry Run keys, modified browser shortcuts |
| Primary Behavior | Homepage/search engine hijacking, forced redirects through globalcret.azurewebsites.net, advertising injection |
| Data Collection | Search queries, browsing history, clicked links, approximate location (via IP), device information |
| Network Indicators | Connections to *.azurewebsites.net domains, redirect chains through multiple tracking domains |
| Common Artifacts | Browser extension with obfuscated name, modified Default_Search_Provider policies, LNK file modifications |
| System Performance Impact | Moderate—slowed browsing, increased memory usage from multiple redirects, potential exposure to malvertising |
| Removal Difficulty | Moderate to High—reinstalls itself if all components not removed simultaneously |
| Associated Risks | Exposure to scam sites, credential phishing pages, further malware downloads, privacy violation |
How It Spreads
Globalcret.azurewebsites.net reaches computers primarily through deceptive software distribution practices that prey on users who don't carefully read installation screens. The most common infection vector is bundled software—free utilities, video converters, PDF tools, and download managers that include the hijacker as an "optional offer" buried in custom installation screens. These bundlers often use dark pattern design: the option to decline is a small, unemphasized checkbox while the "Recommended Installation" prominently includes the unwanted software.
We also see this hijacker distributed through fake update notifications that appear while browsing sketchy websites. These prompts claim your Flash Player, video codec, or browser needs updating, but the downloaded file actually installs the hijacker alongside (or instead of) any legitimate software. Torrent sites, illegal streaming platforms, and free software repositories are particularly notorious for hosting these fake update chains.
Common distribution channels include:
- Bundled freeware installers — Video downloaders, system optimizers, and file converters from third-party download sites that package the hijacker as a "partner offer"
- Fake update prompts — Browser pop-ups claiming you need a critical plugin or codec update, leading to executable downloads
- Malicious advertising networks — Malvertising campaigns on legitimate sites that trigger drive-by downloads or convincing fake alerts
- Compromised browser extensions — Initially legitimate extensions that get sold to malicious actors and updated to include hijacking code
- Email attachments from spam campaigns — Less common for hijackers, but some variants arrive as ZIP files disguised as invoices or documents
- Peer-to-peer networks — Cracked software and keygens that bundle the hijacker with the pirated application
What It Does On Your Machine
Once installed, Globalcret.azurewebsites.net immediately targets your web browser settings, starting with your homepage and default search engine. Instead of Google or your chosen search provider, every new tab and search query gets routed through the globalcret.azurewebsites.net domain, which then bounces you through a series of redirects. These redirects serve multiple purposes: they obscure the final destination, make it harder to block the traffic, and allow multiple affiliate partners in the redirect chain to register a click and earn revenue.
The hijacker achieves its persistence through multiple redundant mechanisms. It typically installs a browser extension with an innocuous or system-sounding name, sets enterprise policy restrictions that prevent you from changing search engines back, modifies your browser shortcuts to include command-line parameters that force the homepage, and creates scheduled tasks that monitor and restore the hijacker if you remove it manually. This multi-layered approach means that removing just one component—say, uninstalling the extension—doesn't solve the problem because the scheduled task simply reinstalls it.
Beyond the visible annoyance of constant redirects, this hijacker collects substantial browsing data. Every search query you enter passes through the hijacker's servers before reaching any search results, giving the operators a complete log of your search history. The redirect domains also track which results you click, how long you spend on pages, and build a behavioral profile used for targeted advertising. While this data collection might not rise to the level of credential theft, it represents a significant privacy violation—especially if you search for sensitive health information, financial services, or anything personal.
The redirect chains themselves can expose you to genuinely dangerous content. While some redirects land on low-quality but harmless search aggregators earning affiliate revenue, others route through malvertising networks that serve exploit kits, tech support scams, or fake antivirus warnings. We've seen cases where the redirect path changed mid-infection, apparently based on geography or bidding from different advertising networks, meaning the threat level can escalate even if you've "gotten used to" the hijacker.
Manual Removal — Step by Step
Disconnect from the Internet
Unplug your Ethernet cable or disable Wi-Fi to prevent the hijacker from communicating with its command servers or downloading additional components. Some hijacker variants pull down updated configuration files when they detect removal attempts, so breaking that connection first makes the removal process cleaner.
Boot into Safe Mode with Networking
Restart your computer and press F8 repeatedly during boot (or hold Shift while clicking Restart on Windows 10/11, then navigate to Troubleshoot > Advanced Options > Startup Settings > Restart > press 5 for Safe Mode with Networking). Safe Mode prevents most startup items from running, which blocks the hijacker's persistence mechanisms from immediately restoring themselves.
Uninstall Suspicious Programs
Open Control Panel > Programs and Features (or Settings > Apps on Windows 10/11) and look for recently installed programs you don't recognize, especially those installed around the time the redirects started. Look for generic names like "Browser Assistant," "Search Manager," or anything that sounds vaguely system-related but you didn't intentionally install. Uninstall all suspicious entries.
Remove Browser Extensions and Reset Settings
Open each affected browser and remove all extensions you don't recognize. In Chrome, go to chrome://extensions; in Firefox, go to about:addons; in Edge, go to edge://extensions. After removing suspicious extensions, reset your browser settings: Chrome (Settings > Reset settings > Restore settings to their original defaults), Firefox (about:support > Refresh Firefox), Edge (Settings > Reset settings). This clears hijacked search engines and homepage settings.
Check and Repair Browser Shortcuts
Right-click on your browser shortcuts (on Desktop, taskbar, and Start menu) and select Properties. Look at the Target field—it should end with just "chrome.exe" or "firefox.exe" without any additional URLs or parameters after it. If you see anything like --homepage=http://globalcret.azurewebsites.net, delete everything after the .exe, click Apply, and OK. Create fresh shortcuts if needed by navigating to the browser's installation folder.
Delete Scheduled Tasks and Startup Entries
Open Task Scheduler (search for it in the Start menu) and look through the Task Scheduler Library for tasks created around the infection date or with suspicious names related to browser updates or system maintenance. Delete any that trigger executables from %TEMP% or %LOCALAPPDATA% folders with random names. Then open Task Manager > Startup tab and disable any entries pointing to suspicious locations.
Clean Registry Persistence Keys
Press Win+R, type regedit, and press Enter. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and look for entries with random names or paths pointing to %LOCALAPPDATA% or %TEMP% folders. Delete suspicious entries. Also check HKEY_CURRENT_USER\Software\Policies\Google\Chrome and HKEY_CURRENT_USER\Software\Policies\Mozilla\Firefox for hijacked policy settings and delete the entire Chrome or Firefox policy key if present and you don't use enterprise policies.
Delete the Hijacker's Program Folder
Navigate to %LOCALAPPDATA% (type it in the Windows Explorer address bar) and look for folders with random names or those created around the infection date containing executable files you don't recognize. Delete these entire folders. Also check %TEMP% for similar suspicious folders and delete them. Empty your Recycle Bin afterward.
Run Malwarebytes or Similar Scanner
Reconnect to the internet and download Malwarebytes Free (from malwarebytes.com directly—not a third-party site). Install it, update the definitions, and run a full Threat Scan. This catches components you might have missed and identifies other potentially unwanted programs that often travel with browser hijackers. Quarantine everything it finds.
Reboot Normally and Verify Removal
Restart your computer in normal mode and open your browser. Check that your homepage and search engine are what you expect and try a few searches to confirm you're not getting redirected. Monitor for a day or two—some hijackers have delayed restore mechanisms. If redirects return, you missed a persistence component and should bring the machine to professionals.
Prevention
- Always choose Custom/Advanced installation when installing free software, even from sources that seem legitimate. Read every screen carefully and uncheck any boxes offering to "enhance your browsing experience," install browser helpers, or change your homepage. The default "Recommended" installation almost always includes unwanted extras.
- Download software only from official sources. Avoid third-party download sites like Softonic, Download.com, or CNET Downloads, which often wrap legitimate installers in their own bundle-laden downloaders. Go directly to the software publisher's website, even if it means an extra minute of searching.
- Keep a real-time antimalware tool active. Windows Defender is decent for basic protection, but adding Malwarebytes Premium or similar provides behavioral detection that catches PUPs and hijackers before they install. Free versions work too if you remember to scan weekly.
- Ignore browser pop-ups claiming you need updates. Legitimate browsers and plugins update themselves automatically or through their own built-in update mechanisms. If something claims you need to download an update from a website, it's almost certainly malicious. Close the tab immediately.
- Use an ad blocker with anti-malvertising lists. Extensions like uBlock Origin (not just plain AdBlock) include filter lists that block known malicious advertising networks and deceptive download buttons. This dramatically reduces exposure to infection vectors on legitimate sites that unknowingly serve malvertising.
- Review installed programs monthly. Set a calendar reminder to check Programs and Features for anything you don't recognize. PUPs often sneak in during routine software installations, and catching them early—before they establish full persistence—makes removal far easier.
- Maintain system and software updates. While hijackers don't typically exploit security vulnerabilities (they rely on social engineering), keeping Windows and browsers updated ensures you have the latest security features and protections against the drive-by downloads that sometimes accompany hijacker distribution.
- Create a Standard user account for daily use. Administrator accounts allow software to install without prompting. Using a Standard account means that even if you accidentally run a hijacker installer, Windows will ask for admin credentials before it can install—giving you a chance to cancel. Save the admin account for intentional software installations only.
Bring It In
Browser hijackers like Globalcret.azurewebsites.net are specifically designed to resist the removal methods average users know about. The multi-layered persistence, the policy restrictions, the scheduled tasks that restore deleted components—these aren't accidental features. They're deliberately engineered to keep the hijacker generating revenue for as long as possible, and manual removal often becomes a game of whack-a-mole where you fix one thing only to have another restore it.
We see these infections daily at our Roswell shop, and we have the tools and experience to remove every component in a single session—registry policies, hidden services, the whole works. More importantly, we verify the removal worked and scan for the other unwanted programs that typically piggyback on hijackers. Give us a call at (770) 954-1958 or stop by our location on Alpharetta Street. Most hijacker removals are same-day service, and we'll have you back to normal browsing—with improved defenses—before the redirects have a chance to expose you to something worse.