Security

Fake Download Campaign Delivers Trojanized Installers

3 min read

Summary

Microsoft Threat Intelligence detailed a fake-download campaign that uses trojanized Inno Setup-style installers to silently deliver multiple monetization payloads in a single session. The activity matters to IT and security teams because it can turn devices into proxy, compute, or adware assets without informed user consent, increasing privacy, performance, and security risk.

Need help with Security?Talk to an Expert

Introduction

Microsoft Threat Intelligence has uncovered a fake-download campaign that targets users looking for cracked software, free games, activators, plugins, and unofficial tools. For organizations, this is more than a consumer risk: the campaign can quietly install unwanted software that abuses device network and compute resources, creating security, privacy, and performance concerns.

What’s new

The campaign uses trojanized Inno Setup-style installers that stage payloads from temporary folders such as %TEMP%\is-*.tmp\. Rather than dropping a single threat, the installer can deliver multiple monetization “offers” during one installation session.

Key characteristics Microsoft observed include:

  • Fake software lures posing as cracks, game installers, unlock tools, plugins, and utilities
  • Inno wrapper execution chains that launch temporary runners and numbered eld*.exe stages
  • Offer-based callbacks using recurring parameters such as d=inno and r=offer_execution
  • Multiple monetization branches that can be installed independently in the same session

Microsoft confirmed three main downstream outcomes:

  • Proxy monetization via WorldProxyPool, which can route third-party internet traffic through the affected device
  • Compute monetization via CharityEngine and BOINC, which can consume local system resources
  • Adware-style utility installs such as AW Manager and Windows Manager

In some cases, payloads may launch before or around the callback activity, which means defenders should not rely on network indicators alone for prevention.

Why this matters for IT administrators

This campaign highlights the ongoing risk of potentially unwanted applications (PUA) and deceptive software bundling. Even when some installed components have legitimate uses, silent deployment without user awareness can:

  • Degrade endpoint performance
  • Introduce persistence mechanisms such as scheduled tasks
  • Increase outbound network risk and privacy exposure
  • Complicate incident response because multiple payloads may be installed in one session

Organizations should pay close attention to suspicious execution from %TEMP%\is-*.tmp\, unusual scheduled tasks running as SYSTEM, and unexpected software installations tied to untrusted downloads.

IT and security teams should consider the following next steps:

  • Block untrusted software sources and discourage downloads of cracks, activators, and unofficial utilities
  • Enable PUA protection in Microsoft Defender
  • Monitor for Inno-style staging behavior, including /SL5, /SPAWNWND, and /FIRSTWND arguments
  • Review scheduled tasks and persistence artifacts associated with newly installed software
  • Use Microsoft’s hunting guidance and IOCs from the security research post to investigate related activity

For defenders, the key takeaway is clear: this campaign is designed to monetize endpoints in several ways at once, so strong application control, Defender protections, and endpoint monitoring are essential.

Need help with Security?

Our experts can help you implement and optimize your Microsoft solutions.

Talk to an Expert

Stay updated on Microsoft technologies

Read the original article by Microsoft Security Research and Jiacen Xu
Microsoft Securitytrojanized installersPUAproxywarethreat intelligence

Related Posts

Security

Microsoft Agent 365 Named Leader in Gartner 2026

Microsoft has been named a Leader in Gartner’s inaugural 2026 Magic Quadrant for AI Agent Management Platforms, highlighting momentum behind Microsoft Agent 365. For IT and security teams, the news underscores Microsoft’s push to bring identity, governance, discovery, and risk-based controls to enterprise AI agents across Microsoft and third-party ecosystems.

Security

Exploited Vulnerabilities: Key Patterns Defenders Must Know

Microsoft Security’s latest analysis shows that only about 0.5% of disclosed CVEs are exploited in the wild, but attackers consistently favor high-impact flaws such as remote code execution, privilege escalation, and authentication bypass. The findings matter for defenders because patching critical systems often takes weeks or longer, while weaponization can happen within days of disclosure.

Security

Claude Code Extension Attack: SSH Backdoor Findings

Microsoft Threat Intelligence analyzed a malicious Claude Code-branded extension briefly distributed through the Cursor marketplace that attempted to install an SSH backdoor, create reverse tunnels, and establish persistence. The incident appears limited to Cursor marketplace, but organizations should identify affected systems, preserve evidence, remove artifacts, and review endpoint and network telemetry for signs of compromise.

Security

AD CS ESC1 and ESC8 Attacks: Microsoft Findings

Microsoft Threat Intelligence detailed two intrusions where attackers used Microsoft Teams help desk impersonation and Quick Assist sessions to gain remote access, then abused Active Directory Certificate Services through ESC1 and ESC8 paths. The research highlights how misconfigured AD CS environments can turn a socially engineered session into durable privileged access, making certificate hardening and containment coverage critical for defenders.

Security

North Korean Threat Actors Expand AI Attack Tradecraft

Microsoft Threat Intelligence says North Korean threat actors are rapidly expanding AI use across reconnaissance, social engineering, tooling development, and operational scaling. The report matters for security teams because AI is accelerating familiar attack chains rather than replacing them, increasing the speed and volume of targeted campaigns against financial, technology, government, and education organizations.

Security

Microsoft Defender Named a Leader in IDC 2026

Microsoft has been named a Leader in the 2026 IDC MarketScape for Worldwide Modern Endpoint Security for Enterprises. The recognition highlights Microsoft Defender’s autonomous attack disruption, generally available agentic AI in Security Copilot, and broad cross-platform coverage, signaling continued investment in faster, AI-driven endpoint protection for enterprise security teams.