Fake software installers are turning your PCs into profit centers for hackers
Summary
Microsoft has documented a campaign that distributes trojanized fake installers, disguised as cracked software, games, plugins, and utilities, through fake download pages. The installers deliver multiple software packages in one session, including three monetization components such as WorldProxyPool that consume victims' computing resources and bandwidth without informed consent. Microsoft recommends blocking untrusted software sources, enabling potentially unwanted application protection, and monitoring for unexpected installations and persistence mechanisms.
IFF Assessment
The campaign successfully monetizes compromised endpoints through deceptive installers, which undermines defenders' control over their systems and networks.
Defender Context
Defenders should block downloads from untrusted sources, enable potentially unwanted application (PUA) protection, and watch for unexpected software installs, rotating C2-style HTTP callbacks with parameters like 'd=inno' and 'r=offer_execution', and persistence mechanisms. This fits a broader trend of pirated-software lures and bundled adware or proxyware being used to monetize infected machines.