Microsoft exposes trojanised installers monetising Windows devices

On 03 November 2026, Microsoft Threat Intelligence disclosed a fake-download campaign that uses trojanised Inno Setup installers to monetise Windows devices. The attackers disguise the installers as cracked software or game utilities, and the campaign delivers multiple payloads via a per-offer system. The operation is attributed to an unaffiliated pay-per-install affiliate network rather than a named threat group.

The trojanised installers wrap the legitimate Inno Setup process and then drop further stages, with the first stage acting as a temporary runner that spawns numbered executables (eld0.exe to eld5.exe) and uses silent installation switches to install the monetisation software without prompts.

Evidence cited includes the transmission of affiliate IDs, offer IDs and network parameters to track deployments across distribution partners, and the ability for subsequent payloads to install even if the first stage is blocked.

Researchers describe three monetisation branches linked to specific offers. Offer 1727 installs WorldProxyPool, turning the host into a residential proxy exit node and creating SYSTEM-level scheduled tasks (WorldProxyPoolAgent, WorldProxyPoolWatchdog, WorldProxyPoolUpdater). Offer 1720 deploys CharityEngine, BOINC and VirtualBox 7.2.8 to hijack CPU/GPU resources for distributed computing tasks.

A third stage, eld3.exe, runs an MSI named Windows Manager – Postback Johan.msi to install Advanced Windows Manager and Windows Updater adware. Defences recommended by Microsoft include blocking downloads from unverified software portals, enabling Potentially Unwanted Application protection, auditing Windows Task Scheduler for WorldProxyPool-related tasks, and removing related programs if infection is confirmed, followed by full endpoint remediation. The article notes that Microsoft did not disclose a total victim count.