Microsoft identified a real campaign that tricks people into downloading cracked software, free games, activators, and unofficial utilities. The fake installers silently add multiple unwanted programs that can use the victim’s internet connection, computing power, or device for advertising-related software. The clearest prevention message is simple: avoid untrusted software downloads and treat “free” cracked tools as a high-risk lure.
Microsoft identified a real campaign built around fake downloads promoted as cracked commercial software, free games, activators, plugins, executors, and unofficial utilities. Once a user downloads and runs one of these fake installers, a trojanized Inno Setup-style package can deliver several monetization payloads in a single installation session, often without informed user consent. Confirmed payload branches included WorldProxyPool proxyware, CharityEngine or BOINC distributed-computing software, and AW Manager or Windows Manager utility-style adware. The installer used recurring offer-execution callbacks and rotating domains to select and deliver downstream payloads, and WorldProxyPool specifically created SYSTEM-level scheduled tasks for startup, watchdog, and updater activity, giving the unwanted software persistent access to the device (T1053.005).
The lure relies on everyday curiosity: users searching for a free game, an audio plugin, a Roblox executor, an auto-clicker, or a driver tool land on a polished download page offering what looks like a normal installer (T1204.002). Because these products and components can have legitimate uses, the installer masquerades as something routine while silently bundling additional software (T1036). The execution chain varied by session, and different offers could succeed or fail independently, so blocking one unwanted component did not guarantee the rest of the bundle was stopped.
Employees across all roles, especially developers, creative staff, and anyone downloading utilities or plugins, should only install software from approved internal catalogs or official publisher sites and avoid cracked software, key generators, or activation tools on work devices. Treat any free download that requests running an installer as a security decision, particularly for game cheats, executors, auto-clickers, driver tools, or commercial plugins. Organizations can reduce exposure by preventing use of untrusted software sources, enabling potentially unwanted application protection, and monitoring for unexpected software installations and persistence mechanisms. Employees should also report unexpected installations or unusual device behavior promptly, since unwanted software may consume bandwidth or computing resources without an obvious warning sign.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is a campaign where trojanized Inno Setup-style installers promoted as cracked software, free games, activators, or utilities silently deliver multiple monetization payloads in one installation session.
Confirmed payload branches installed WorldProxyPool proxyware, CharityEngine or BOINC distributed-computing software, or AW Manager and Windows Manager utility-style adware.
WorldProxyPool created SYSTEM-level scheduled tasks for startup, watchdog, and updater activity, giving the unwanted software persistent access to the device.
Organizations can prevent use of untrusted software sources, enable potentially unwanted application protection, and monitor for unexpected software installations and persistence mechanisms.
“Download Echo Client.” Free utility, polished page. Tempting? Run its Inno Setup-style installer, and one install can quietly add several extras: WorldProxyPool, CharityEngine/BOINC, or AW Manager. No clear permission, no obvious warning. Here’s the catch: “free” can mean your bandwidth or computing power pays instead. WorldProxyPool can even create SYSTEM-level tasks to keep running. A blocked extra doesn’t stop the rest. Need software for work? Get it from our approved catalog or the publisher’s official site, not a cracked-download page.
Microsoft reports an active campaign where attackers set up counterfeit software download pages that mimic well-known brands and trick users into installing malware. Victims visit a look-alike vendor site, click “Download now,” then run a bundled installer that drops persistent malware and connects…
A Ukraine-based grain logistics company was breached through a spearphishing email carrying a malicious attachment. UAC-0099 used the access to install backdoors, then handed access to Sandworm, which later deployed a data-wiping attack. The initial email attachment is a realistic…
Microsoft reports Russia-linked Star Blizzard sent fake event invitations and other business notices to trick targets into opening disguised files that install a Windows backdoor. The campaigns targeted Ukraine-linked people and organizations and hit 100+ organizations, mainly in the U.S. and U.K.,…
Researchers report real-world campaigns targeting European government and diplomatic organizations using diplomatic-themed Microsoft Word documents. Victims are prompted to click “Enable Content,” which runs malicious macros that install the HOOKEDGE backdoor and connect to webhook-based…
FortiGuard Labs reports an active phishing operation (“TTF Trap”) where emails posing as invoices, shipping documents, or business proposals deliver an archive that ultimately runs malware on Windows. The trick is a file ending in .ttf (TrueType font) that is actually a malicious script executed by…
The Yoba malware campaign uses fake GitHub projects and search-result manipulation to make counterfeit ChatGPT and Claude downloads look trustworthy. Victims receive a real, signed installer alongside malware, so the application appears legitimate while the malicious software installs and…
