Fake installers quietly monetize Windows PCs

A download that looks like a free shortcut — a cracked copy of Navicat Premium, a FabFilter audio plugin, an unofficial game patch — can end up costing the user far more than the price of a license. Microsoft said it has observed an evolving campaign in which trojanized installers turn downloading Windows machines into sources of revenue for someone else, consuming computing resources and internet bandwidth without informed consent.

The activity, detailed in a Microsoft blog post, centers on fake download pages and Inno Setup-style installers that deliver several software packages in a single installation session. Three monetization components were observed in the campaign, and Microsoft noted that some of them may have legitimate uses when installed knowingly — a distinction that matters, because the campaign's whole trick is that the user never knowingly agrees to any of it.

Lures sold as cracked software

The campaign starts where users go looking for something free or cheaper than retail. Installers are advertised as cracked software, games, activators, plugins, or unofficial utilities, according to Microsoft. Lures were observed posing as products such as Navicat Premium and FabFilter audio plugins, alongside gaming and utility downloads.

That framing is the bait: the user believes they are getting a specific tool, and the installer does deliver on that expectation while also doing things the user did not ask for. Because the file arrives through an unofficial channel, there is no publisher signature or store review standing between the download and the machine.

Microsoft's write-up treats the download itself as the initial access point, which places the entire burden of the compromise on the moment the user runs the installer rather than on a later exploitation step.

Inno Setup wrapper and numbered payloads

The technical mechanism is built around packaging. The installers use an Inno Setup-style wrapper to stage temporary executables under Windows' temporary directories, Microsoft said. Numbered payloads then execute and coordinate the delivery of additional software.

Microsoft described the campaign as featuring an offer-based delivery mechanism. The installer communicates with rotating infrastructure using HTTP callbacks that carry parameters such as “d=inno” and “r=offer_execution”. Those requests let the campaign track individual software offers, so multiple payloads can succeed or fail independently within the same installation session.

That design gives the operation resilience. If one payload does not land on a given machine, the others can still run, and the callback tells the operators which offers are working. Rotating infrastructure makes the network side of the campaign harder to pin down to a single fixed host.

Three branches of monetization

Microsoft grouped the payloads into three monetization branches, each turning the infected device into a different kind of asset.

The first is WorldProxyPool, which installs proxyware to route third-party internet traffic through the victim's device. It also creates SYSTEM-level scheduled tasks for agent startup, watchdog execution, and updates. The watchdog arrangement is what keeps the component running even if something interferes with it — the device is expected to keep serving traffic.

Another branch installs CharityEngine and Berkeley Open Infrastructure for Network Computing (BOINC), alongside components such as VirtualBox, to facilitate distributed computing. Contributors to such projects ordinarily choose to donate their spare cycles; here the choice is made for them.

A third installs utility-style software associated with Advanced Windows Manager and Windows Manager. Microsoft said these applications may participate in advertising, software distribution, or affiliate-driven monetization.

What Microsoft wants organizations to do

The company's guidance is shaped around blocking the download before it becomes an installation. Microsoft recommends preventing downloads from untrusted sources, particularly cracked software, key generators, unofficial game installers, and activation tools.

For organizations running Microsoft Defender Antivirus, the company said defenders should enable cloud-delivered protection, maintain tamper protection, and configure reputation-based protection to block untrusted applications and downloads. It also recommends evaluating Attack Surface Reduction (ASR) rules that restrict executable files based on prevalence, age, or trusted-list criteria.

On detection and investigation, Microsoft advised checking for execution from Inno temporary directories, especially when files such as “eld*.exe”, “set_*.exe”, “FirstFast[1].exe”, or “SecondRunner[1].exe” appear. It also recommended correlating outbound requests containing “d=inno” and “r=offer_execution” or “r=offer_execution_fail” with process activity, scheduled-task creation, and software installations.

Unexpected WorldProxyPool, CharityEngine, BOINC, or VirtualBox installations warrant investigation, the company said. Defender XDR customers can use Microsoft's published advanced hunting queries to identify related activity, and a list of indicators of compromise was shared to help defenders outside the Microsoft ecosystem.

The company's own guidance

Microsoft distilled its position into a short statement covering both prevention and the limits of endpoint tooling on its own.

“Organizations can reduce their exposure to this activity by preventing the use of untrusted software sources, enabling potentially unwanted application protection, and monitoring for unexpected software installations and persistence mechanisms,”

— Microsoft, in its blog post on the campaign

The company added that its Defender XDR detects and blocks several payloads and behaviors related to the campaign — a claim that places the burden of detection on the security stack while the guidance points back at download habits as the first line of defense.

The components have day jobs

One uncomfortable wrinkle in the campaign is that the software it installs is not inherently malicious in every context. Proxyware, BOINC-based distributed computing, and utility suites are all things people install deliberately for legitimate reasons. Microsoft said as much, noting that some components may have legitimate uses when installed knowingly.

That ambiguity complicates detection. A machine running VirtualBox or a BOINC-based client is not automatically compromised, and an investigator looking only at process names could find themselves looking at software that has an ordinary explanation. The difference lies in consent and context — whether the user chose the software, and whether the installation was expected.

Microsoft's suggested correlation steps reflect that: outbound requests tied to the offer-execution parameters, scheduled-task creation, and software installations are meant to be read together rather than treated as isolated signals.

Why the download decision matters

For businesses, this campaign is a reminder that the perimeter around software acquisition is permeable wherever users can reach unofficial download sites. An employee chasing a cheap audio plugin or an unlicensed utility is not a dramatic insider threat, but the result can be a machine that quietly serves proxy traffic and donates compute cycles to someone else's operation. That traffic and those cycles have costs — in bandwidth, in performance, and potentially in how the device's outbound connections appear to others.

The controls Microsoft lists are mostly familiar ones: block untrusted sources, turn on protection for potentially unwanted applications, watch for installations nobody requested, and keep an eye on persistence mechanisms. What the campaign illustrates is that these controls are only as good as their coverage of the mundane downloads users make on their own initiative. This suggests the practical gap is less about novel malware and more about whether organizations treat unofficial software acquisition as a real risk surface — and whether their detection rules are tuned to notice the specific temporary-directory executions, callback parameters, and scheduled tasks that this campaign leaves behind.