Microsoft Details Fake-Download Campaign Using Trojanized Installers for Monetization

Nov 3, 2026 · Original article ↗

Summary

Microsoft describes a fake-download campaign that uses trojanized Inno-style installers to silently deploy proxyware, distributed-computing software, and adware-style utilities, and provides investigation and mitigation guidance.

Key points

Lures offer cracked software, games, activators, plugins, and unofficial utilities; running them launches temporary Inno-style runners and staged executables.
Installers use per-offer callbacks with a recurring d=inno and r=offer_execution pattern to track payload delivery and installation results.
Microsoft confirmed three monetization branches: WorldProxyPool proxyware; CharityEngine and BOINC distributed computing; and Advanced Windows Manager or Windows Manager utilities.
WorldProxyPool creates SYSTEM-level scheduled tasks for agent startup, a five-minute watchdog, and an hourly updater.
Microsoft recommends avoiding untrusted downloads, enabling Defender protections, and investigating Inno temporary-directory execution, unexpected scheduled tasks, and software installations.
Defender XDR hunting queries correlate callbacks, staged executables, network activity, and persistence; Microsoft cautions that domain-only matches are leads, not confirmation.

Article Details

Attack Vectors: Users ran fake installers promoted as cracked software, games, activators, plugins, executors, or unofficial utilities.
Inno Setup-style installers staged temporary runners under %TEMP%\is-*.tmp\ and launched numbered executables such as eld*.exe.
Staged runners contacted rotating callback infrastructure using d=inno and r=offer_execution or r=offer_execution_fail query parameters.
Delivered payloads used unattended installation switches to install proxyware, distributed-computing software, or utility-style software; the WorldProxyPool branch also created recurring SYSTEM scheduled tasks.
Defensive Notes: Avoid cracked software, key generators, unofficial game installers, and other untrusted software sources.
Enable Microsoft Defender Antivirus cloud-delivered protection, tamper protection, and reputation-based protection; consider applicable Attack Surface Reduction rules.
Investigate execution from Inno temporary directories, including staged eld*.exe, set_*.exe, FirstFast[1].exe, and SecondRunner[1].exe files.
Correlate outbound requests containing d=inno with r=offer_execution or r=offer_execution_fail and related process, file, persistence, and network activity.
Review unexpected SYSTEM scheduled tasks and audit software inventories for unrequested WorldProxyPool, CharityEngine, BOINC, VirtualBox, or other installations.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`beliefdesk[.]xyz`	Offer-execution callback infrastructure observed in the campaign.
DOMAIN	`belieftrack[.]cfd`	Observed campaign infrastructure listed for hunting outbound connections.
DOMAIN	`companyharbor[.]xyz`	Offer-execution callback infrastructure observed in the campaign.
DOMAIN	`cratebase[.]cfd`	Observed campaign infrastructure listed for hunting outbound connections.
DOMAIN	`fallport[.]cfd`	Observed campaign infrastructure listed for hunting outbound connections.
DOMAIN	`foldlodge[.]xyz`	Observed campaign infrastructure listed for hunting outbound connections.
DOMAIN	`friendsanchor[.]xyz`	Observed campaign infrastructure listed for hunting outbound connections.
DOMAIN	`inkact[.]xyz`	Offer-execution callback infrastructure observed in the campaign.
DOMAIN	`orbittrack[.]cfd`	Observed campaign infrastructure listed for hunting outbound connections.
DOMAIN	`prairielink[.]cfd`	Observed campaign infrastructure listed for hunting outbound connections.
DOMAIN	`signalpane[.]cfd`	Offer-execution callback infrastructure observed in the campaign.
DOMAIN	`stonestation[.]cfd`	Observed campaign infrastructure listed for hunting outbound connections.
DOMAIN	`willowbox[.]xyz`	Observed campaign infrastructure listed for hunting outbound connections.
DOMAIN	`wishcourt[.]cfd`	Observed campaign infrastructure listed for hunting outbound connections.
DOMAIN	`wishgrove[.]cfd`	Offer-execution callback infrastructure observed in the campaign.
SHA256	`006510ce1da2b7410376f0788c19e55616eb4bcc30072d25b7d0871dc32aa11c`	Hash of an Inno second-stage runner observed in the campaign.
SHA256	`21306fc5716f95e252388f920314b42f1c8bcc7df67cb4d39da30217b96f4044`	Hash of an earlier Inno loader observed in the campaign.
SHA256	`452a210bba4c8d08f7cb7733a816d7220a7fa570a469aea0a997cfc8b594b6a0`	Hash of an Inno eld0 / eld1 first-stage payload observed in the campaign.
SHA256	`523fb81fae0c7beba7b5171243cc0dee7a4d04ae0483be9172eef2394a5a2152`	Hash of an Inno eld0 first-stage payload observed in the campaign.
SHA256	`55cd3d36fdcc58016a64398357b2c9724a060da9f0d09266e537a61ec9552e4f`	Hash of a later Inno eld2-eld5 payload observed in the campaign.
SHA256	`72750d32b440e9f2b6d05ff3d218a561a75d3d75fb976b461fa59897674a7f70`	Hash of an earlier Inno second-stage runner observed in the campaign.
SHA256	`ab2c2dd37fdcfe1e7620a57f98c80bd063258bea145adc0cc6a0f8b1e24c6a8f`	Hash of an Inno eld0 first-stage payload observed in the campaign.