Fake-download campaign uses trojanized installers to deliver monetization payloads

What it is

A Microsoft Threat Intelligence write-up (3 November 2026) of a fake-download campaign. Trojanized Inno Setup-style installers, posing as cracked software, games, activators, plugins and Roblox executors, run several monetized "offers" in one install session. Lures named include Echo Client, FabFilter Total Bundle, Navicat Premium crack and Command & Conquer: Red Alert 2.

How it works

The installer starts a temporary runner under %TEMP%\is-*.tmp\, which launches numbered stages such as eld*.exe and set_*.exe. Arguments /SL5, /SPAWNWND and /FIRSTWND appear on these stages. The runner then calls rotating domains with randomized URL paths but a fixed query string: d=inno, r=offer_execution, plus offer (o), download-network (dn), affiliate, placement and session values. Blocked offers report r=offer_execution_fail, sometimes with local error text about a virus or PUA. Offers succeed or fail independently, so one failed offer does not stop the bundle. Payloads install silently with /qn, /S, /quiet and /norestart.

Observed offer/network pairs include o=1712/dn=507, o=1720/dn=536, o=1727/dn=564, o=1729/dn=566, o=331/dn=244, o=1674/dn=440, o=1675/dn=441, o=1681/dn=447 and o=1730/dn=567.

WorldProxyPool creates three SYSTEM scheduled tasks for components under C:\Program Files\WorldProxyPool\:

• WorldProxyPoolAgent runs sdk-agent.exe at startup with highest privileges.
• WorldProxyPoolWatchdog runs a hidden, noninteractive PowerShell script every five minutes.
• WorldProxyPoolUpdater runs sdk-agent.updater.exe update hourly.

The installer also starts the agent with schtasks.exe /Run.

The CharityEngine/BOINC branch installs under C:\Program Files\BOINC\ and C:\ProgramData\BOINC\, including VirtualBox 7.2.8 (VirtualBox-7.2.8-r173730.msi). The AW Manager/Windows Manager branch drops AdvancedWindowsManager.exe and Windows Updater.exe under %APPDATA%\AW Manager\ or C:\Program Files (x86)\AW Manager\.

Preconditions / Affected

A user must run a fake installer. Endpoints where users can run unvetted downloads are exposed. Resulting harm is resource hijacking (T1496): third-party traffic routed through the device, or its compute enrolled in a distributed platform.

What to do

Hunt in Defender XDR for the callback pattern:

DeviceNetworkEvents 
| where RemoteUrl has "d=inno" 
| where RemoteUrl has_any ("r=offer_execution", "r=offer_execution_fail") 
| project Timestamp, DeviceName, RemoteUrl, InitiatingProcessFileName 

Hunt for staged executables from Inno temp directories:

DeviceProcessEvents 
| where FolderPath has @"\AppData\Local\Temp\is-" 
| where FileName matches regex @"(?i)^(eld[0-9]+|set_[0-9]+|FirstFast(?:\[1\])?|SecondRunner(?:\[1\])?)\.exe$" 
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, SHA256 

A third query matches 15 observed domains, including orbittrack.cfd, prairielink.cfd, willowbox.xyz and wishgrove.cfd. The full list is in the post's IOC section.

Other actions the post states:

• Audit for unexpected scheduled tasks, especially SYSTEM watchdog or updater tasks.
• Audit software inventory for WorldProxyPool, CharityEngine, BOINC and VirtualBox that users did not install.
• Enable cloud-delivered protection, tamper protection and reputation-based protection.
• Consider ASR rules that block executables failing prevalence, age or trusted-list criteria.

Caveats

Domains are short-lived, so domain-only matches are leads, not confirmation. The durable signal is the callback pattern combined with Inno temp execution and staged filenames. Some EDR traces show child payloads launching before or around the callback, so the callback is not always the earliest prevention point. The offer-role table is based on telemetry correlation, not confirmed server-side definitions. The post says to validate the queries against the current Defender XDR schema. Products involved may have legitimate uses, and the risk comes from silent installation without informed consent.