Fake Installers Turn PCs Into Profit Machines

Microsoft observed a real campaign using fake download pages and trojanized installers promoted as cracked software, games, plugins, and utilities. Victims who run the downloads can unknowingly install proxy software, distributed-computing tools, and adware-style monetization components that consume company bandwidth and computing power.

Key findings

• The campaign uses fake download pages and Inno Setup-style installers that deliver several payloads in one installation session.
• Lures include cracked commercial software, free games, activators, plugins, and unofficial utilities, including products presented as Navicat Premium and FabFilter audio plugins.
• One payload branch installs WorldProxyPool proxyware, allowing third-party internet traffic to pass through the victim's device.
• Other branches install CharityEngine, BOINC, and VirtualBox for distributed computing, or utility-style software associated with advertising and affiliate monetization.
• Microsoft identified suspicious temporary installer files, outbound HTTP parameters including "d=inno" and "r=offer_execution", and unexpected scheduled tasks or installations as investigation indicators.

Who’s being targeted

• Commonly targeted roles: All employees using Windows devices, Creative and media teams, Developers and technical staff, IT support, Desktop administrators, Security operations teams.
• Affected industries: All industries using Windows devices, Organizations with employees permitted to install unapproved software.
• Attack channels: website.
• Impersonated: A software download site offering Navicat Premium or FabFilter audio plugins, An unofficial software distributor.

Awareness takeaways

• Only download software from approved vendor or organization-managed sources; never use cracked software, key generators, activators, or unofficial installers on work devices.
• Treat an installer that adds unrelated programs or makes unexpected offers as suspicious, and stop the installation rather than clicking through.
• Report unexpected software installations or unexplained performance and bandwidth problems, especially if proxyware or distributed-computing tools appear.
• Security teams should investigate installers launched from temporary directories and correlate them with suspicious outbound requests or new scheduled tasks.

Red flags to watch for

• The software is advertised as cracked, activated, or unofficial.
• The download is from an untrusted source rather than the vendor's official site.
• The installer offers or installs multiple unrelated applications.
• The offer involves a key generator, activator, or cracked application.
• Unexpected software such as WorldProxyPool, CharityEngine, BOINC, or VirtualBox appears after installation.
• The device shows unexplained bandwidth or CPU use after an unofficial download.