Hackers Use Fake Software Downloads to Secretly Hijack Windows PCs and Monetize Their Resources

Hackers are using fake software downloads to quietly turn Windows computers into revenue sources, installing programs that share internet bandwidth, run computing workloads, or deliver unwanted utilities.

The campaign targets people searching for cracked commercial software, free games, activation tools, plugins, and unofficial applications, hiding extra installations behind what appears to be an ordinary setup process.

Rather than delivering one payload, the installers can attempt several installations during the same session. Each component becomes a separate opportunity to monetize the device.

The approach reflects a wider problem seen in fake software installer campaigns, where familiar installation screens can conceal background activity that users never knowingly approved.

Microsoft researchers identified the evolving campaign and documented three confirmed installation branches in their November 3 technical analysis.

These delivered WorldProxyPool proxy software, CharityEngine and BOINC distributed-computing components, and Advanced Windows Manager utilities.

Microsoft stressed that legitimate software can create security and privacy risks when installed through deceptive bundles without informed consent.

Hackers Use Fake Software Downloads

The attack begins when someone launches a download advertised as a game, cracked application, audio plugin, or utility.

Observed lures included Echo Client, FabFilter Total Bundle, Navicat Premium cracks, Roblox executors, and mobile-unlock tools. These names describe the campaign’s disguises, not evidence that the genuine products were compromised.

The installer then launches temporary processes through an Inno Setup-style wrapper and starts numbered payload stages.

Previous reporting on abuse of Inno Setup shows how attackers can exploit a familiar installation framework to hide additional execution. Here, the wrapper coordinates multiple downstream packages instead of simply installing the application the user expected.

The delivery system calls these packages “offers.” It contacts changing internet infrastructure to select payloads and report installation outcomes, using session and affiliate-related values to connect events.

Crucially, each offer can succeed or fail independently. A blocked component therefore does not prove that the entire installation chain stopped or that the computer remained unaffected.

WorldProxyPool provides the bandwidth-monetization branch, routing third-party internet traffic through affected devices. Its installation creates three scheduled tasks running as SYSTEM: one starts the agent at boot, another runs a hidden PowerShell watchdog every five minutes, and a third checks for updates hourly.

Similar fake downloads installing proxyware illustrate why unauthorized network sharing deserves attention alongside more familiar malware threats.

The computing branch installs CharityEngine, BOINC, and supporting components, including VirtualBox. Microsoft observed computing workloads, capability checks, and communication with CharityEngine infrastructure.

This is resource hijacking, but the report does not establish cryptocurrency mining. Separately, the utility branch installs Advanced Windows Manager and updater-style software through the same delivery system, extending the bundle beyond network and computing-resource abuse.

Detecting Resource Hijacking and Blocking Unwanted Installations

The strongest detection approach connects installation activity, outbound requests, new software, and persistence changes rather than relying on a single filename or domain.

Microsoft noted that callback domains rotate frequently, while the broader execution pattern remains consistent. Analysts should examine the complete installer session because reporting requests may occur after, or around the time, child payloads start.

Defenders should review unexpected scheduled tasks, especially those running as SYSTEM, and investigate software that users did not intentionally install.

Earlier research into malware delivering BOINC clients provides useful context, although Microsoft’s report does not establish a connection between those operations.

A legitimate component’s presence alone is not proof of compromise; its installation history and surrounding behavior matter.

Microsoft recommends avoiding cracked software and unofficial download sources, enabling potentially unwanted application protection, and keeping cloud-delivered antivirus, tamper protection, and reputation-based checks active.

Organizations can also evaluate attack surface reduction rules that restrict untrusted executables. These controls address the central weakness exploited here: users approving an apparently useful download without understanding the additional software it installs.

Indicators of compromise (IoCs):-

Type	Indicator	Associated component
Domain	beliefdesk[.]xyz	Offer-execution callbacks
Domain	companyharbor[.]xyz	Offer-execution callbacks
Domain	signalpane[.]cfd	Offer-execution callbacks
Domain	inkact[.]xyz	Offer-execution callbacks
Domain	wishgrove[.]cfd	Offer-execution callbacks
File path	%TEMP%\is-*.tmp\eld*.exe	Staged payload pattern
File path	C:\Program Files\WorldProxyPool\sdk-agent.exe	Proxyware agent
Scheduled tasks	WorldProxyPoolAgent / WorldProxyPoolWatchdog / WorldProxyPoolUpdater	SYSTEM-level persistence
SHA-256	006510ce1da2b7410376f0788c19e55616eb4bcc30072d25b7d0871dc32aa11c	Inno second-stage runner
SHA-256	21306fc5716f95e252388f920314b42f1c8bcc7df67cb4d39da30217b96f4044	Earlier Inno loader
SHA-256	72750d32b440e9f2b6d05ff3d218a561a75d3d75fb976b461fa59897674a7f70	Earlier second-stage runner
SHA-256	ab2c2dd37fdcfe1e7620a57f98c80bd063258bea145adc0cc6a0f8b1e24c6a8f	First-stage payload
SHA-256	452a210bba4c8d08f7cb7733a816d7220a7fa570a469aea0a997cfc8b594b6a0	First-stage payload
SHA-256	523fb81fae0c7beba7b5171243cc0dee7a4d04ae0483be9172eef2394a5a2152	First-stage payload
SHA-256	55cd3d36fdcc58016a64398357b2c9724a060da9f0d09266e537a61ec9552e4f	Later staged payload

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.