Fake software installers are turning your PCs into profit centers for hackers

Users looking for cracked commercial software, free games, plugins, and unofficial utilities could be signing up for more than a free download. Microsoft has observed an evolving campaign that uses trojanized installers to turn the downloading Windows devices into money-making machines, consuming their computing resources and internet bandwidth without informed consent. The campaign uses fake download pages and Inno Setup-style installers to deliver multiple software packages during a single installation session, Microsoft said in a blog post. The campaign was found distributing three monetization components, some of which may have legitimate uses when installed knowingly. “Organizations can reduce their exposure to this activity by preventing the use of untrusted software sources, enabling potentially unwanted application protection, and monitoring for unexpected software installations and persistence mechanisms,” the company said, adding that its Defender XDR detects and blocks several payloads and behaviors related to the campaign. Fake installers used for real money The campaign begins with users downloading installers advertised as cracked software, games, activators, plugins, or unofficial utilities. Microsoft observed lures posing as products like Navicat Premium and FabFilter audio plugins, alongside gaming and utility downloads. The installers use an Inno Setup-style wrapper to stage temporary executables under Windows’ temporary directories. Numbered payloads subsequently execute and coordinate the delivery of additional software. Microsoft said the campaign features an offer-based delivery mechanism. The installer communicates with rotating infrastructure using HTTP callbacks containing parameters such as “d=inno” and “r=offer_execution”. These requests allow the campaign to track individual software offers, allowing multiple payloads to succeed or fail independently within the same installation session. The first monetization branch is WorldProxyPool, which installs proxyware to route third-party internet traffic through the victim’s device. It also creates SYSTEM-level scheduled tasks for agent startup, watchdog execution, and updates. Another branch installs CharityEngine and Berkeley Open Infrastructure for Network Computing (BOINC), alongside components such as VirtualBox, to facilitate distributed computing. A third installs utility-style software associated with Advanced Windows Manager and Windows Manager. These applications may participate in advertising, software distribution, or affiliate-driven monetization. Microsoft urges defenders to scrutinize unofficial software Microsoft recommends preventing downloads from untrusted sources, particularly cracked software, key generators, unofficial game installers, and activation tools. Organizations using Microsoft Defender Antivirus should enable cloud-delivered protection, maintain tamper protection, and configure reputation-based protection to block untrusted applications and downloads, the company said. It also recommends evaluating Attack Surface Reduction (ASR) rules that restrict executable files based on prevalence, age, or trusted-list criteria. For detection and investigation, organizations were advised to check execution from Inno temporary directories, especially when files such as “eld*.exe, set_*.exe”, “FirstFast[1].exe”, or “SecondRunner[1].exe” appear. Microsoft also recommends correlating outbound requests containing “d=inno” and “r=offer_execution” or “r=offer_execution_fail” with process activity, scheduled-task creation, and software installations. Unexpected WorldProxyPool, CharityEngine, BOINC, or VirtualBox installations warrant investigation, it said. Defender XDR customers can use Microsoft’s published advanced hunting queries to identify related activity, while a list of indicators of compromise (IOCs) was also shared to help defenders outside the Microsoft ecosystem.