As cited
Copy frozen at (site build).
threat intel
Fake-download campaign uses trojanized installers to deliver monetization payloads
Microsoft Threat Intelligence has documented a fake-download campaign that delivers trojanized Inno Setup installers to users seeking cracked software, free games, and unauthorized tools. The installers execute a multi-stage attack chain that deploys monetization payloads, including proxyware (WorldProxyPool), distributed-computing software (CharityEngine/BOINC), and adware utilities, while establishing persistence through scheduled tasks. The campaign uses rotating callback infrastructure with a consistent query-string pattern (d=inno and r=offer_execution) to coordinate payload delivery and track installation outcomes across affected devices.
Why it matters: Any organization with users downloading software from untrusted sources faces exposure to this bundled malware, which silently converts endpoints into monetized assets for proxy abuse, compute hijacking, or adware without user consent. Defenders should monitor for Inno temporary execution paths, offer-callback network patterns, scheduled-task creation with SYSTEM privileges, and unexpected software installations to detect and block this activity before monetization stages persist.
- Source published
- First seen by Cybersecurity Tracker