Technology
Microsoft: fake installers of pirated software and games turn Windows PCs into a revenue source for third parties
Microsoft Threat Intelligence describes a campaign of trojanized Inno Setup installers that silently add proxyware, distributed-computing software and adware to PCs of people downloading cracked software.
The installer of a “pirated” program or game can do far more than it promises: silently turn the user’s computer into a source of revenue for third parties. That is what Microsoft Threat Intelligence describes in an analysis published on Tuesday, November 3, 2026 on its security blog, about an evolving campaign of fake downloads. These are trojanized Inno Setup installers (a popular tool for building Windows installers) that carry extra software, so-called “offers,” which is installed in the same setup process.
The lure is familiar: “cracked” versions of commercial programs, free games, illegal activation tools (activators), add-ons and unofficial utilities. Microsoft recorded as examples pirated audio plug-ins, PC games, Roblox script executors, auto-clickers and tools for drivers. Names it mentions include Echo Client, the FabFilter Total Bundle, a crack of Navicat Premium and Command & Conquer: Red Alert 2. The download pages are polished, with screenshots and repeated “Download” buttons.
How the installer works
Once the user runs the file, the installer launches a temporary intermediate program (runner) in the %TEMP%\is-*.tmp\ folder, which runs numbered stages with names such as eld0.exe, eld1.exe and eld4.exe, with command-line parameters such as /SL5, /SPAWNWND and /FIRSTWND. It then contacts constantly changing servers with a fixed request structure: d=inno and r=offer_execution, together with identifiers for the offer, distribution affiliate, download network and position in the execution queue. If an offer fails, the request becomes r=offer_execution_fail. Offers succeed or fail independently of one another, so failure of the first does not mean the whole package stopped.
Microsoft confirmed three ways infected devices are monetised. It notes these programs may have legitimate uses, but silently installing them without informed user consent creates security and privacy risks. The first is WorldProxyPool, software that routes third-party traffic through the computer (proxyware). Stage eld4.exe creates three scheduled tasks with SYSTEM privileges: one launching the sdk-agent.exe agent at system startup, one with a hidden PowerShell watchdog script that runs every five minutes, and one that updates the program every hour. The second branch enrols the device in a distributed-computing platform with CharityEngine and BOINC, together with VirtualBox 7.2.8. The third installs helper applications with adware characteristics, Advanced Windows Manager and Windows Manager.
Detections and recommendations
The analysis also records the related detections. Microsoft Defender detects the payload as Trojan:Win64/OfferLoader.DA!MTB and OfferLoader.DB!MTB, the behaviour as Behavior:Win32/SuspInnoOffer.A!mapsi and, at the resource-hijacking stage, as Adware:Win32/Clover. The techniques map to seven entries of the MITRE ATT&CK framework, among them user execution of a malicious file (T1204.002), persistence via scheduled task (T1053.005), ingress tool transfer (T1105) and resource hijacking (T1496).
For those looking for traces, Microsoft publishes indicators of compromise (IOCs). The domain names of the servers receiving the offer reports are beliefdesk[.]xyz, companyharbor[.]xyz, signalpane[.]cfd, inkact[.]xyz and wishgrove[.]cfd, while the advanced hunting query includes 15 in total. The company stresses that domain names change quickly and that a steadier signal is the combination of the d=inno pattern, the temporary folders and the stage names.
Recommendations include avoiding untrusted software sources, key generators and activation tools, turning on cloud protection and tamper protection in Defender, reputation-based protection and attack surface reduction rules. Administrators are urged to check scheduled tasks with SYSTEM privileges and look for software users did not install, such as WorldProxyPool, CharityEngine, BOINC and VirtualBox. The same week, the team published its quarterly phishing threat report.
