VULNpocalypse
MediumSupply chainActive

Fake software downloads deliver trojanized Inno installers that monetize Windows PCs

Microsoft reports cracked-software and game lures that use trojanized Inno-style installers to install proxyware, compute and adware payloads on Windows.

Published
Updated
Exploitation
Yes, Microsoft Threat Intelligence observed the campaign delivering payloads in investigated installer sessions

What happened

Microsoft Threat Intelligence described an evolving fake-download campaign aimed at users searching for cracked commercial software, free games, activators, plugins and unofficial utilities. It uses trojanized Inno Setup-style installers to deliver several monetized software payloads, called “offers” by the delivery system, in a single installation session. Microsoft Security Blog

Observed lures include Echo Client, FabFilter Total Bundle, Navicat Premium crack, Cue Club, an auto-clicker, Deadpool Apunka Games, Command & Conquer: Red Alert 2, TFT Unlock Tool and clownfishvoicechanger. Microsoft Security Blog These names describe the disguises, not evidence that the genuine products were compromised. Cyber Security News

The attack chain has four stages:

  • The user runs a fake installer. The installer launches an Inno Setup-style temporary runner under %TEMP%\is-*.tmp\, which starts numbered stages such as eld*.exe and set_*.exe. Arguments such as /SL5, /SPAWNWND and /FIRSTWND help identify the sequence. Microsoft Security Blog
  • The runner contacts rotating infrastructure using a repeatable d=inno and r=offer_execution callback pattern. Offer, affiliate, download-network, placement and session values coordinate payload selection. Failed offers report r=offer_execution_fail. Microsoft Security Blog
  • Payloads install with unattended switches such as /qn, /S, /quiet and /norestart. Microsoft Security Blog
  • One or more of three confirmed monetization branches is installed, as described below.

The three confirmed branches are:

  • WorldProxyPool routes third-party internet traffic through the device. It installs under C:\Program Files\WorldProxyPool\ and creates three scheduled tasks running as SYSTEM. One starts the agent at boot, one runs a hidden PowerShell watchdog every five minutes, and one runs an updater hourly. GBHackers
  • CharityEngine and BOINC enroll the device in a distributed-computing platform and install components including boinc.exe, charityengine.exe, compute wrappers and VirtualBox. This is not a confirmed cryptocurrency-mining operation. GBHackers
  • Advanced Windows Manager and Windows Manager deliver adware-style utility software, including AdvancedWindowsManager.exe and Windows Updater.exe through an MSI package. GBHackers

Each offer can succeed or fail independently, so a blocked first offer does not prove the whole bundle stopped. Child payloads sometimes launch before or around the callback, so the callback is not always the earliest prevention point. Microsoft Security Blog

Microsoft notes that these products may have legitimate uses. The risk comes from silent installation through deceptive bundles without informed consent. Microsoft Security Blog The number of affected devices, the operator identity and any CVE are not confirmed in the sources.

Am I affected?

You may be affected if any user on your network has run a cracked application, game installer, activator, plugin, executor or unofficial utility from an untrusted source. Check endpoints for the following signals:

  • Processes or files matching %TEMP%\is-*.tmp\eld*.exe, or Inno temporary runners launched with /SL5, /SPAWNWND and /FIRSTWND. Microsoft Security Blog
  • Outbound HTTP requests containing d=inno and r=offer_execution or r=offer_execution_fail. Microsoft Security Blog
  • Scheduled tasks named WorldProxyPoolAgent, WorldProxyPoolWatchdog or WorldProxyPoolUpdater, and the file C:\Program Files\WorldProxyPool\sdk-agent.exe. Cyber Security News
  • Unexpected installs of CharityEngine, BOINC, VirtualBox or AW Manager. Separate authorized deployments from bundled installs, because a legitimate component alone is not proof of compromise. GBHackers
  • Callback domains reported so far, defanged here: beliefdesk[.]xyz, companyharbor[.]xyz, signalpane[.]cfd, inkact[.]xyz and wishgrove[.]cfd. Cyber Security News Domains rotate frequently, so the pattern is a more durable signal than any single domain. Microsoft Security Blog

What to do now

  1. Block or prohibit untrusted software sources, and tell users not to run cracked software, activators or unofficial installers. Microsoft Security Blog
  2. Enable potentially unwanted application protection so detected files and installation attempts are blocked and quarantined. Microsoft’s guidance covers deployment through Intune, Group Policy and PowerShell. GBHackers
  3. Keep Defender real-time and behavior monitoring, cloud-delivered antivirus, tamper protection and reputation-based checks active. Cyber Security News
  4. Consider attack surface reduction rules that restrict untrusted executables. Cyber Security News
  5. Hunt by correlating the callback pattern, Inno temporary execution paths, staged filenames and related installer-session activity rather than relying on single domains or filenames. Microsoft Security Blog
  6. Review scheduled tasks running as SYSTEM and inventory WorldProxyPool, CharityEngine, BOINC, VirtualBox and AW Manager across your fleet. GBHackers
  7. On a confirmed infection, treat a blocked offer as inconclusive. Examine the whole installer session for other offers that succeeded and for new persistence. Cyber Security News

Sources