Search Česky

Actively exploited Security news

Fake ‘cracked software’ installers turn PCs into proxy and compute nodes

On 3 November 2026 Microsoft Threat Intelligence described a campaign that lures people to fake download pages for cracked software, game installers and activators. One run of the trojanized installer can quietly add proxyware, a BOINC-based compute client and adware, persisted through SYSTEM-level scheduled tasks. Here is what to look for on your endpoints.

Kyberkit editorial team · · event date · reading time 4 minutes · For everyone

Actively exploited: WorldProxyPool

Key points

  • Fake download pages offer cracked software, ‘free’ games, activators and unofficial tools. The installer is a trojanized Inno Setup package that runs several monetised ‘offers’ in a single session.
  • Payloads described by Microsoft: WorldProxyPool proxyware (sells the victim's bandwidth), CharityEngine/BOINC with VirtualBox components (uses the CPU) and an adware-style ‘AW Manager / Windows Manager’ utility.
  • WorldProxyPool persists through three SYSTEM-level scheduled tasks: WorldProxyPoolAgent, WorldProxyPoolWatchdog (every 5 minutes) and WorldProxyPoolUpdater (hourly).
  • Check for execution from %TEMP%\is-*.tmp\, the scheduled tasks and the domains and hashes below. Microsoft gives no victim count or date range.

What happened

On 3 November 2026 Microsoft published research into a fake-download campaign. People searching for cracked commercial software, free games, activators, plugins, game ‘executors’ or unofficial utilities land on pages that imitate software-download sites. Lures named by Microsoft include Navicat Premium, FabFilter Total Bundle, Command & Conquer: Red Alert 2, Echo Client, an auto-clicker and the Clownfish voice changer.

What they download is a trojanized Inno Setup installer. Instead of (or alongside) the promised program it runs several paid ‘offers’ in one session – the operators earn money per installation. Microsoft describes the campaign as evolving and gives no victim numbers or date range.

How the infection works

Infection chain of the fake-download campaign1. User downloads a ‘cracked’ installer from a fake download page; 2. Inno runner in %TEMP%\is-*.tmp starts numbered stages eld*.exe and set_*.exe; 3. Callback with d=inno and r=offer_execution picks the payloads; 4. Silent installs of proxyware, BOINC compute client or adware; 5. SYSTEM scheduled tasks keep WorldProxyPool running1User downloads a ‘cracked’ installerfrom a fake download page2Inno runner in %TEMP%\is-*.tmp startsnumbered stages eld*.exe andset_*.exe3Callback with d=inno andr=offer_execution picks the payloads4Silent installs of proxyware, BOINCcompute client or adware5SYSTEM scheduled tasks keepWorldProxyPool running
From a fake download page to persistent proxyware (Microsoft, 3 November 2026)

The temporary runner sends HTTP callbacks containing d=inno and r=offer_execution (or r=offer_execution_fail). Offer, affiliate and session parameters in the callback decide which payloads follow. These then install silently (/qn, /S, /quiet, /norestart) in one or more of three branches:

Branch What it does Where it lands
WorldProxyPool proxyware – resells the victim's bandwidth C:\Program Files\WorldProxyPool\ (sdk-agent.exe, sdk-agent.updater.exe, watchdog.ps1)
CharityEngine / BOINC uses the CPU for paid computing, adds VirtualBox components C:\Program Files\BOINC\, C:\ProgramData\BOINC\ (boinc.exe, charityengine.exe, ce11.exe)
AW Manager / Windows Manager adware-style utility AppData or C:\Program Files (x86)\AW Manager\ (AdvancedWindowsManager.exe, Windows Updater.exe)

In MITRE ATT&CK terms this is mainly resource hijacking (T1496): bandwidth and compute are the stolen goods. For WorldProxyPool, Microsoft observed three scheduled tasks running as SYSTEM with highest privileges: WorldProxyPoolAgent (at startup), WorldProxyPoolWatchdog (hidden PowerShell every five minutes) and WorldProxyPoolUpdater (hourly).

Who is affected

Windows users who download pirated software, cracks, keygens or game mods from unofficial sites – at home and on company laptops where users can install software. For organisations the risk is not only wasted resources: proxyware makes other people's traffic leave through your public IP address.

For home users: if you installed a ‘cracked’ program recently and your PC is slower, the fan runs constantly or you see WorldProxyPool, BOINC or CharityEngine among installed programs you never chose, follow the steps below.

How to tell if you were compromised

Indicators published by Microsoft (domains defanged; Microsoft notes the operators rotate domains, so a domain match is a lead, not proof):

beliefdesk[.]xyz
companyharbor[.]xyz
signalpane[.]cfd
inkact[.]xyz
wishgrove[.]cfd
orbittrack[.]cfd
prairielink[.]cfd
willowbox[.]xyz
stonestation[.]cfd
foldlodge[.]xyz
friendsanchor[.]xyz
fallport[.]cfd
wishcourt[.]cfd
cratebase[.]cfd
belieftrack[.]cfd

SHA-256 of installer stages:

006510ce1da2b7410376f0788c19e55616eb4bcc30072d25b7d0871dc32aa11c
21306fc5716f95e252388f920314b42f1c8bcc7df67cb4d39da30217b96f4044
72750d32b440e9f2b6d05ff3d218a561a75d3d75fb976b461fa59897674a7f70
ab2c2dd37fdcfe1e7620a57f98c80bd063258bea145adc0cc6a0f8b1e24c6a8f
452a210bba4c8d08f7cb7733a816d7220a7fa570a469aea0a997cfc8b594b6a0
523fb81fae0c7beba7b5171243cc0dee7a4d04ae0483be9172eef2394a5a2152
55cd3d36fdcc58016a64398357b2c9724a060da9f0d09266e537a61ec9552e4f

What else to hunt for:

  • processes started from %TEMP%\is-*.tmp\ named eld*.exe, set_*.exe, FirstFast[1].exe or SecondRunner[1].exe,
  • outbound requests whose URL contains d=inno together with r=offer_execution or r=offer_execution_fail,
  • new scheduled tasks named WorldProxyPool* – Windows logs task creation as Security event 4698 if the Audit Other Object Access Events subcategory is enabled,
  • Defender detections Trojan:Win64/OfferLoader.DA!MTB, Trojan:Win64/OfferLoader.DB!MTB, Behavior:Win32/SuspInnoOffer.A!mapsi, Adware:Win32/Clover and Trojan:Win32/OffLoader.A.

Paste the list above, or your own proxy and EDR exports, into our IOC extractor to get clean lists for your SIEM; a suspicious file's hash can be checked in the hash calculator. Both run only in your browser. Look up event 4698 and related IDs in our Windows Event ID lookup.

What to do

  1. Isolate and inventory. Check affected machines for WorldProxyPool, CharityEngine, BOINC, VirtualBox and AW Manager installs nobody requested, and for the three scheduled tasks.
  2. Clean up. Remove the tasks and software, then run a full Defender scan. Because the chain ran with SYSTEM rights, reinstalling Windows is the safer option on machines that also hold sensitive data.
  3. Turn on protections recommended by Microsoft: cloud-delivered protection, tamper protection, SmartScreen reputation-based protection and relevant Attack Surface Reduction rules.
  4. Block and monitor the listed domains on your proxy or DNS resolver, and alert on the d=inno callback pattern.
  5. Close the door. Users shouldn't be able to install software from random sites; offer an approved software catalogue instead.

Timeline

Timeline of the fake-download campaign report3 Nov 2026: Microsoft publishes the research with IOCs and hunting queries; 10 Nov 2026: Kyberkit checks the post; no victim count or attribution given3 Nov 2026Microsoft publishes theresearch with IOCs andhunting queries10 Nov 2026Kyberkit checks the post; novictim count or attributiongiven
Publication and our check (Microsoft)

FAQ

Is this malware or ‘just’ adware?

Microsoft Defender detects the loaders as trojans (OfferLoader, OffLoader) and one component as adware (Clover). Whatever the label, the user never knowingly agrees to rent out their bandwidth or CPU, and the tasks run as SYSTEM, so treat the machine as compromised.

Why is proxyware a problem for a company?

Proxyware lets strangers route their traffic through your network. Anything they do then appears to come from your IP address, which can get it blocklisted or tie it to abuse. It also consumes bandwidth.

Is blocking the listed domains enough?

No. Microsoft says the operators rotate callback domains frequently and that a domain match alone is a lead, not proof. Hunt for the process paths, the scheduled tasks and the d=inno callback parameters as well.

Who is behind the campaign?

Microsoft doesn't attribute it to a named group. The post describes an affiliate-style offer network that pays per installation.

Sources

  1. Microsoft Security Blog – Fake-download campaign uses trojanized installers to deliver monetization payloads (3 November 2026)
  2. MITRE ATT&CK – T1496 Resource Hijacking
  3. Microsoft Learn – 4698(S) A scheduled task was created

Spotted a mistake? Let us know and we will correct it openly.