Microsoft Threat Intelligence has detected an active fake download campaign targeting users seeking cracked commercial software versions, free games, activation tools, software plugins, and unofficial utilities. The campaign relies on using compromised installers inspired by the Inno Setup tool to distribute multiple and customized software payloads to generate profits during a single installation session.
Attack Mechanism and Execution System
The campaign progresses through an attack chain consisting of four main stages, starting with the exploitation of fake download baits. The user runs deceptive installation files for various games and software, leading to the creation of temporary installers within system temporary paths and calling sequential digital execution stages.
After the initialization stage, the temporary installer communicates with a rotating callback infrastructure, using a fixed query pattern containing specific campaign indicators. These operations allow for the selection and precise coordination of subsequent payloads within the installation session.
Exploitation Paths and Profit Generation
Technical investigation confirmed the existence of three main branches for profit generation after the installation is complete, which turn the affected devices into physical assets for the attackers:
- Proxy network exploitation (WorldProxyPool): Routing third-party internet traffic through the target device, while creating scheduled tasks with system privileges to ensure the continued operation of the proxy and update tools.
- Computing resource exploitation (CharityEngine and BOINC): Installing distributed computing software to exploit the capabilities of device processors and graphics cards in computational operations without the owner's knowledge.
- Intrusive adware (AdvancedWindowsManager): Installing unwanted service and advertising software within system file paths and user applications.
What Changes Practically for Users and Entities?
This campaign poses serious security and privacy risks due to its reliance on the silent installation of software via deceptive packages. Even if one offer fails during the installation session, other offers may succeed independently. For organizations and users, countering this threat requires completely avoiding untrusted software sources, enabling advanced protection tools in operating systems, and monitoring unusual processes and new scheduled tasks.
Prevention and Detection Measures
Microsoft recommends taking strict preventive steps, including enabling cloud protection and reputation protection in antivirus software, and regularly auditing software inventory for any unwanted applications such as proxy tools or distributed computing software. The company has also provided advanced threat hunting queries and rules to monitor suspicious communications associated with the campaign's domains and its infrastructures.