Microsoft Threat Intelligence says deceptive installers posing as free games, cracked software, activators, audio plugins and utilities are quietly turning victims’ Windows PCs into a source of income, according to Cyber Security News, which covered a Microsoft report dated November 3. Unlike earlier fake-game campaigns that steal passwords, this one monetizes the machine itself.
Microsoft identified three delivery branches. In one, a bandwidth-sharing tool called WorldProxyPool routes third-party internet traffic through the infected device. In another, CharityEngine and BOINC run distributed computing workloads with VirtualBox and supporting components, and Microsoft found no evidence of cryptocurrency mining. A third installs utilities such as Advanced Windows Manager and related updaters.
The installers are built on Inno Setup and launch temporary processes and then further stages that install the bundled software. The delivery system treats each package as an offer and tracks results separately, so if one fails, others can still install, and unattended install options reduce the prompts users see. The proxy agent runs with SYSTEM privileges through scheduled tasks that start at boot, with a hidden PowerShell watchdog every five minutes and update checks every hour. The report gives no figures for affected devices.
Microsoft advises avoiding cracked software, unofficial game installers and activation tools, turning on cloud-delivered protection, tamper protection and reputation-based blocking, and treating unwanted software as a real risk even when it is not classified as malware. Defenders can review software inventories for unauthorized installs and correlate installer execution with network callbacks and newly created scheduled tasks.