Microsoft Threat Intelligence has uncovered a sophisticated fake-download campaign that targets users seeking cracked software, free games, and unofficial utilities. This campaign employs trojanized Inno Setup-style installers to deliver multiple monetized software payloads, referred to as “offers,” during a single installation session. The findings highlight a concerning trend in how malicious actors exploit user behavior to monetize compromised devices.
The investigation revealed that these installers utilize a per-offer callback and status-tracking model to manage delivery and record installation outcomes. Three distinct monetization branches were confirmed, which transform affected devices into monetized assets. This includes routing third-party internet traffic through the device, enrolling it in distributed computing platforms, or installing additional utility-style software—often without the users’ informed consent. While some of these components may have legitimate uses, their silent installation through deceptive software bundles raises significant security and privacy concerns.
Attack Chain Overview
The fake-download campaign follows a four-stage attack chain:
- Initial access via fake download lures: Users are tricked into running fake installers that masquerade as cracked software or unofficial utilities.
- Inno wrapper execution and temporary runner staging: The installer launches an Inno Setup-style temporary runner that initiates multiple stages of execution.
- Offer execution callback and payload delivery: The runner contacts rotating infrastructure to manage payload selection and correlate activity within the installer session.
- Final payload installation and monetization: Staged payloads are installed using unattended switches, leading to various monetization outcomes.
Initial Access via Fake Download Lures
The campaign begins when users download and execute fake installers that are often promoted as cracked software or game installers. Examples of these lures include popular software like Echo Client and various game executors. The deceptive nature of these installers is a critical factor in the campaign’s success, as they exploit users’ desire for free or cracked software.
Inno Wrapper Execution and Temporary Runner Staging
Upon execution, the user-launched lures spawn Inno Setup-style temporary runners that initiate a series of numbered stages. The depth of this execution chain varies, with some installers launching multiple stages and reaching several monetization branches, while others may expose fewer components.
Final Payload Installation and Monetization
After the offer callback and payload delivery, the campaign installs software across three monetization branches: proxy and network-resource monetization, compute-resource monetization, and adware-style utility monetization. For instance, the WorldProxyPool branch installs a proxy agent that creates scheduled tasks for persistent operation, while the CharityEngine and BOINC branch installs distributed-compute software that hijacks user resources for monetization.
Mitigation and Protection Guidance
To reduce exposure to this campaign, Microsoft recommends several actions:
- Avoid untrusted software sources: Users should refrain from downloading cracked software or unofficial installers, which are common vectors for malware.
- Enable cloud-delivered protection: Ensuring that Microsoft Defender Antivirus is configured for cloud-delivered protection can enhance detection capabilities.
- Keep tamper protection enabled: This feature helps prevent unauthorized changes to security settings.
- Enable reputation-based protection: This can help block known malicious applications and downloads.
- Consider Attack Surface Reduction (ASR) protections: Evaluate ASR rules to block executable files that do not meet specific criteria.
By implementing these measures, organizations can better defend against the risks posed by such deceptive campaigns and protect their users from potential harm.
For further details on this campaign and related threat intelligence, refer to the Microsoft Security Blog.
