Microsoft details fake installer campaign delivering monetisation payloads

Microsoft Threat Intelligence has detailed a four-stage fake-download campaign that uses trojanised Inno Setup-style installers to deliver monetisation payloads. The operation targets users seeking cracked commercial software, free games, activators, plugins, and unofficial utilities, with lures promoted as Echo Client, FabFilter Total Bundle, Navicat Premium crack, and other similar titles.

The campaign employs an Inno wrapper that runs a temporary runner in %TEMP%\\is-*.tmp, triggering staged executables such as eld*.exe before delivering monetisation payloads in a single installation session, according to Microsoft Defender telemetry and investigated samples.

Downstream, the campaign loads three monetisation branches: WorldProxyPool for proxyware/network-resource monetisation; CharityEngine and BOINC for distributed computing; and AW Manager/Windows Manager for adware-style utilities. WorldProxyPool installs SYSTEM-level scheduled tasks (WorldProxyPoolAgent, WorldProxyPoolWatchdog, WorldProxyPoolUpdater) and persists via startup execution and a hidden PowerShell watchdog.

CharityEngine/BOINC installs distributed-compute components and VirtualBox, while AW Manager/Windows Manager installs related utilities under AppData or Program Files and may run updater and postback components. The campaign coordinates delivery with a per-offer callback system, using a rotating infrastructure and structured query parameters (notably d=inno and r=offer_execution or r=offer_execution_fail) to select and report payloads.

Microsoft Defender XDR detects and blocks related payloads through cloud protection, machine-learning classification, network inspection, and behavioural monitoring; advanced hunting queries are provided to identify Inno-order callbacks, staged payloads in Inno temporary directories, and outbound campaign infrastructure.