People hunting for cracked software, free games and game cheats are being handed installers that quietly turn their computers into rented infrastructure. Microsoft Threat Intelligence, in research credited to Microsoft Security Research and Jiacen Xu, says a fake-download campaign uses trojanized Inno Setup-style installers to push several paid "offers" onto a device in a single install session, often without the user's informed knowledge or consent.
Microsoft confirmed three ways the operation earns money from a victim's machine: routing third-party internet traffic through it, enrolling it in a distributed-computing platform, or installing extra utility-style software. The company stresses that some of these products may have legitimate uses. The problem is their silent installation through deceptive bundles, which it says introduces security and privacy risks.
The lures are software people want for free
Observed lures included cracked audio plugins, PC games, Roblox executors, auto-clickers, activators, driver tools and mobile-unlock utilities. Named examples in the report include Echo Client, a FabFilter Total Bundle, a Navicat Premium crack, Command & Conquer: Red Alert 2 and a generic auto-clicker.
Once launched, the installer starts a temporary runner under %TEMP%\is-*.tmp\, which then launches numbered stages such as eld0.exe through eld5.exe or set_*.exe. Microsoft notes that these paths and stage names, plus installer arguments like /SL5, /SPAWNWND and /FIRSTWND, are more durable indicators than the lure's own file name.
Every offer phones home with its own result
The runner calls rotating infrastructure using random URL paths but a fixed query-string pattern containing d=inno and r=offer_execution, or r=offer_execution_fail when an offer is blocked. Offer, affiliate, download-network and placement values let the operators track which payload was attempted and whether it installed. Offers succeed or fail independently, so one blocked offer does not stop the rest of the bundle. Because the domains rotate often, Microsoft says the durable hunting signal is the callback pattern combined with Inno temporary execution, not any single domain.
Three ways a hijacked PC earns money
- WorldProxyPool proxyware. A staged eld4.exe created three SYSTEM-level scheduled tasks: WorldProxyPoolAgent runs sdk-agent.exe at startup, WorldProxyPoolWatchdog runs a hidden PowerShell watchdog every five minutes, and WorldProxyPoolUpdater runs hourly.
- CharityEngine and BOINC compute. The FabFilter chain silently installed CharityEngine, BOINC, VirtualBox and Visual C++ components, launched BOINC workloads and contacted CharityEngine infrastructure.
- AW Manager and Windows Manager. In one process tree, eld3.exe launched an MSI that installed AdvancedWindowsManager.exe and Windows Updater.exe.
Payloads were installed with unattended switches such as /qn, /S, /quiet and /norestart, so the user sees no further prompts. Microsoft Defender detects related files under names including Trojan:Win64/OfferLoader.DA!MTB, Trojan:Win64/OfferLoader.DB!MTB and Behavior:Win32/SuspInnoOffer.A!mapsi. Bundled proxyware is a recurring theme: IntelFusions recently covered proxyware disguised as a Copilot service and a Rust stealer riding cracked software.
Block cracked installers and hunt the Inno callbacks
Microsoft recommends keeping users away from cracked software and activation tools, enabling potentially unwanted application protection, cloud-delivered protection, tamper protection and reputation-based protection, and evaluating Attack Surface Reduction rules that block executables which do not meet prevalence, age or trusted-list criteria. For investigation, it advises reviewing execution from %TEMP%\is-*.tmp\ (including eld*.exe, set_*.exe, FirstFast[1].exe and SecondRunner[1].exe), watching outbound requests that contain d=inno together with r=offer_execution, auditing newly created SYSTEM scheduled tasks, and checking software inventory for WorldProxyPool, CharityEngine, BOINC or VirtualBox that nobody chose to install.
Indicators of compromise
Selected SHA-256 hashes from Microsoft's report:
- 006510ce1da2b7410376f0788c19e55616eb4bcc30072d25b7d0871dc32aa11c
- 21306fc5716f95e252388f920314b42f1c8bcc7df67cb4d39da30217b96f4044
- 72750d32b440e9f2b6d05ff3d218a561a75d3d75fb976b461fa59897674a7f70
- ab2c2dd37fdcfe1e7620a57f98c80bd063258bea145adc0cc6a0f8b1e24c6a8f
Nothing here steals a password. The price of the "free" download is a machine that keeps working for somebody else, on a schedule, with SYSTEM privileges, long after the game or plugin has been forgotten.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.