Microsoft: Fake Installers Rent Out Your PC in Three Ways

The malware in Microsoft's latest report doesn't steal your files or lock your screen. It turns your PC into a small business for someone else. In a Nov. 3 post on the Microsoft Security Blog, Microsoft Security Research and Jiacen Xu describe a campaign of trojanized Inno Setup-style installers that install "multiple monetized software payloads," which the delivery system calls "offers," during a single installation.

The lure is the kind of download that never comes from a vendor: "cracked commercial software, free games, activators, plugins, and unofficial utilities," in Microsoft's words. It is a security story, not an AI one, but the middle branch involves compute, and anyone who runs a workstation with a GPU should read it.

Microsoft Threat Intelligence's post on X announcing the report (@MsftSecIntel)

View on X

The post lists the three outcomes plainly: "routing third-party internet traffic through the compromised devices," enrolling devices "in a distributed-computing platform," and installing "additional utility software."

One installer, four stages

Microsoft's report lays the chain out in four steps:

1. A fake download page gets the user to run an installer. 2. An Inno-style temporary runner starts numbered stages from %TEMP%\is-.tmp\, such as eld.exe and set_*.exe. 3. The runner calls rotating infrastructure with a repeatable pattern, d=inno together with r=offer_execution, to pick which offers to install. 4. The chosen payloads are installed with unattended switches, one or more per session.

Microsoft's own caveat matters for defenders: the callback parameters are read from telemetry, and the company says some of their meanings are unconfirmed. Its hunting advice is blunt: "Domain-only matches are leads, not confirmation."

Three branches, three different bills

Microsoft says it "confirmed three downstream monetization branches that transformed affected devices into monetized assets."

• WorldProxyPool (network). The device becomes an exit point for other people's traffic. Microsoft describes persistence through three scheduled tasks that run as SYSTEM: an agent at startup, a hidden PowerShell watchdog every five minutes, and an updater hourly.
• CharityEngine and BOINC (compute). The campaign "silently installed CharityEngine/BOINC, VirtualBox, and Visual C++ components," then launched BOINC workloads and contacted CharityEngine infrastructure. Microsoft lists the checks the chain ran, including "GPU or compute-capability checks." The VirtualBox installer it names is version 7.2.8, build r173730.
• AW Manager and Windows Manager (adware). Utility and updater-style software installed alongside the rest.

Our reading: the compute branch is why this belongs near AI readers. Nothing in the report says GPU owners were targeted, and it gives no figure for how much compute was taken. But an installer that checks a machine's compute capability before enrolling it tells you what the operators consider valuable.

Microsoft is careful about one thing, and so should we be. The BOINC and CharityEngine software "may have legitimate uses." The problem it names is installation "without informed user consent."

What the report doesn't say

Microsoft doesn't name an operator, and describes the infrastructure only as rotating. It gives no victim count, no start date and no estimate of traffic or compute taken. It doesn't say how people reach the lure pages: search ads, SEO and affiliate links are all unmentioned. The only hint is an image caption about "polished software-download pages."

It also doesn't link this campaign to its Sept. 1 report on counterfeit installers. That earlier post, by Microsoft Defender Experts, covered fake vendor download sites, mostly on Chinese domains, and assessed "with moderate confidence" an overlap with the publicly reported Silver Fox campaign. The payloads and the aim there were different. We found no sentence in the new report that connects the two, so we don't.

What to check on a machine

Microsoft's preventive list is short: avoid untrusted software sources, enable cloud-delivered protection, keep tamper protection on, enable reputation-based protection, and consider attack surface reduction rules. Its detections include Trojan:Win64/OfferLoader.DA!MTB and Behavior:Win32/SuspInnoOffer.A!mapsi.

For a single machine, the practical checks come straight from the report:

• Scheduled tasks named WorldProxyPoolAgent, WorldProxyPoolWatchdog or WorldProxyPoolUpdater.
• BOINC, CharityEngine or VirtualBox you didn't install.
• Processes launched from %TEMP%\is-*.tmp\.

The report publishes seven SHA-256 hashes and five domains in its indicator table, plus longer lists in the hunting queries.

Five minutes, then every hour

If you build tools that fetch and run software, the useful detail is the schedule. Our reading: a watchdog that wakes every five minutes and an updater that returns every hour means deleting the files alone may not end the problem, since the tasks can bring them back. Microsoft's report doesn't give removal steps, so check the scheduled tasks as well as the folders, and look again an hour later.

Source: Microsoft Security Blog, Fake-download campaign uses trojanized installers to deliver monetization payloads

microsoft inno setup proxyware boinc fake downloads

AI

About the author

AI Briefing Daily Editorial. The editorial desk of AI Briefing Daily, an independent publication covering artificial intelligence. Every story is researched against primary sources, checked by hand and reviewed by a person before publication.