Timing data from Heimdal's own customer environments shows that even a low-severity browser-modifier adware family can finish writing its persistence mechanism to disk before antivirus quarantine completes — a finding the company says holds across more than 40 affected client machines.
MediaArena is a browser-modifier adware family that Microsoft has tracked since 2023. It spreads through fake "free AI tool" ads from a malvertising cluster publicly documented since March and analysed by Compass Apex Security in April. Heimdal's threat intelligence team set out to time a live infection using its own telemetry from active client environments, not a lab or sandbox.
In the case Heimdal measured, MediaArena finished writing its persistence mechanism to disk 21 seconds after execution. Microsoft Defender's quarantine completed at 29 seconds. The gap between persistence and quarantine was eight seconds — enough for the adware to take hold regardless of whether detection fires at all.
The same sequence, persistence completing before quarantine finishes, has been confirmed across more than 40 client environments in recent days, according to Heimdal. After the initial quarantine event, signature-based detection then took approximately 78 days to reach a definitive catch. The browser hijacker ran for around eleven weeks.
"We timed a MediaArena infection and the persistence was on disk before the quarantine even finished. The alert isn't wrong, it's just late. By the time it fires, the adware has already done what it came to do, so a team that stops at 'quarantined' is working from an incomplete picture," said Alexandru Gurgu, Threat Intelligence Security Analyst at Heimdal.
The company's practical guidance for security teams is that a quarantine alert for MediaArena should be treated as the start of an investigation rather than its conclusion. Affected endpoints need to be checked directly for persistence artefacts — the quarantine event marks when detection caught up, not when the threat was stopped.
To stay across the latest in cloud, AI and enterprise tech analysis from Compare the Cloud, subscribe to our weekly newsletter at https://www.comparethecloud.net/newsletter
