EN PT-BR
← Voltar ao feed
medium defense

Microsoft: trojanized Inno Setup fake installers chain proxyware, BOINC/CharityEngine and AW Manager PUA offers on Windows

2 fonte(s) · 2 atualização(ões) · publicado 04/11/2026 02:56 · coletado há 1 hora

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 06/11/2026 04:02; os links antigos trazem para cá.

Fontes: securityonline.info ↗ gbhackers.com ↗

Microsoft (Threat Intelligence) detailed a fake-download campaign on November 3, 2026 (gbhackers.com, securityonline.info). It uses trojanized Inno Setup-style installers disguised as cracked software, games and utilities to monetize Windows PCs. A single installation session delivers several monetized payloads, which the delivery system calls "offers". These are residential proxy agents, distributed-computing software and bundled utilities. Microsoft identified three confirmed branches: WorldProxyPool proxyware, CharityEngine/BOINC distributed computing, and Advanced Windows Manager utilities (gbhackers.com). Lures include Echo Client, FabFilter Total Bundle, Navicat Premium cracks, Command & Conquer: Red Alert 2, Deadpool Apunka Games and TFT Unlock Tool. They target users seeking cracks, audio plugins, game downloads, Roblox executors, auto-clickers and mobile-unlock tools. No threat actor attribution is given in the sources.

Detalhes técnicos

  • An Inno Setup-style wrapper creates a temporary runner under %TEMP%\is-*.tmp\. It launches numbered executables (eld0.exe, eld3.exe, eld4.exe) with arguments such as /SL5, /SPAWNWND and /FIRSTWND (gbhackers.com).
  • The runners beacon to rotating domains with HTTP requests containing d=inno and r=offer_execution. Session, affiliate, offer, download-network and placement parameters coordinate delivery and track outcomes. Failed attempts log r=offer_execution_fail (gbhackers.com).
  • Each offer runs independently, so blocking one payload does not stop the others. The per-offer callback system means remaining payloads still install even if security tools block the first stage (gbhackers.com, securityonline.info).
  • WorldProxyPool installs under C:\Program Files\WorldProxyPool\ and creates three SYSTEM-level scheduled tasks: a boot-time agent start, a five-minute PowerShell watchdog and an hourly updater (gbhackers.com).
  • The CharityEngine/BOINC branch installs boinc.exe, charityengine.exe, compute wrappers and VirtualBox. It enrolls machines in distributed-computing infrastructure; cryptomining is not confirmed (gbhackers.com).
  • The utility branch deploys AdvancedWindowsManager.exe and Windows Updater.exe through an MSI package, using silent switches (/qn, /S, /quiet, /norestart) (gbhackers.com).

Remediação

  • Prohibit untrusted software sources, investigate unexpected installations and audit scheduled tasks tied to these components (Microsoft guidance, via gbhackers.com).
  • Inventory software for WorldProxyPool, CharityEngine, BOINC, VirtualBox and AW Manager, separating legitimate deployments from bundled ones.
  • Enable potentially unwanted application (PUA) protection in Microsoft Defender, with real-time and behavior monitoring. It can be deployed via Intune, Group Policy or PowerShell.
  • Infrastructure rotates frequently, so behavioral detection is more effective than domain blocking. Correlate callback parameters with staged filenames and process activity.

Relatos divergentes

  • Lure list: gbhackers.com does not list Clownfish Voice Changer, while securityonline.info (more recent, November 6) does. The lists are probably complementary rather than contradictory.
  • Timing: gbhackers.com says Microsoft published its research on November 3, 2026. securityonline.info says Microsoft "uncovered" the campaign on that date. This is most likely the publication date of the report.

Linha do tempo

  1. securityonline.info ↗ · pub. 06/11/2026 03:07 · coletado 06/11 04:00

    Trojanized Inno Setup Installers Deliver Proxyware and Compute Hijackers

    ler a análise desta fonte

    On November 3, 2026, Microsoft Threat Intelligence uncovered a fake-download campaign using trojanized installers to monetize Windows devices. Disguised as cracked software and game utilities, these Inno Setup trojanized installers deploy residential proxy agents, distributed computing software, and adware bundles. Furthermore, the campaign uses a per-offer callback system so remaining payloads still install even if security tools block the first stage.

    The attack targets users looking for free versions of commercial programs, game cheats, and system utilities. Observed lures include Echo Client, FabFilter Total Bundle, Navicat Premium cracks, Command & Conquer: Red Alert 2, Deadpool Apunka Games, TFT Unlock Tool, and Clownfish Voice Changer. According to the Microsoft Threat Intelligence report, “The campaign uses trojanized Inno Setup-style installers to distribute multiple monetized software payloads, referred to by the delivery system as “offers”, during a single installation session.”

  2. gbhackers.com ↗ · pub. 04/11/2026 02:56 · coletado 04/11 03:00 primeiro registro

    Fake Software/Game Installers Deploy Multi-Stage PUA Payloads on Windows via Inno Setup Wrappers

    ler a análise desta fonte

    Microsoft published research on November 3, 2026 detailing an evolving fake-download campaign that trojanizes installers disguised as popular games, cracked software, and utilities to monetize Windows PCs. Rather than dropping a single payload, the operation chains multiple unwanted software "offers" within one installation session, converting victim bandwidth and compute resources into revenue through proxyware, distributed-computing enrollment, and bundled utility installs. Microsoft identified three confirmed branches: WorldProxyPool proxyware, CharityEngine/BOINC distributed-computing software, and Advanced Windows Manager utilities. Lures observed include Echo Client, FabFilter Total Bundle, Navicat Premium cracks, Deadpool Apunka Games, Command & Conquer: Red Alert 2, and TFT Unlock Tool, targeting users seeking software cracks, audio plugins, game downloads, Roblox executors, auto-clickers, and mobile-unlock tools.

    Technical Details

    Execution begins with an Inno Setup-style wrapper that creates a temporary runner beneath %TEMP%\is-*.tmp\, launching numbered executables (eld0.exe, eld3.exe, eld4.exe) using arguments like /SL5, /SPAWNWND, and /FIRSTWND. Temporary runners beacon to rotating domains with HTTP requests containing d=inno and r=offer_execution, using session, affiliate, offer, download-network, and placement parameters to coordinate delivery and track outcomes; failed attempts log r=offer_execution_fail. Each offer operates independently, so blocking one payload does not stop others. WorldProxyPool installs under C:\Program Files\WorldProxyPool\ and creates three SYSTEM-level scheduled tasks (boot-time agent start, a five-minute PowerShell watchdog, and an hourly updater). The CharityEngine/BOINC branch installs boinc.exe, charityengine.exe, compute wrappers, and VirtualBox, enrolling machines into distributed-computing infrastructure (not confirmed cryptomining). The utility branch deploys AdvancedWindowsManager.exe and Windows Updater.exe via an MSI package, using silent switches (/qn, /S, /quiet, /norestart) to minimize visibility.

    Remediation

    Microsoft recommends prohibiting untrusted software sources, investigating unexpected installations, and auditing scheduled tasks tied to these components. Organizations should inventory software for WorldProxyPool, CharityEngine, BOINC, VirtualBox, and AW Manager, distinguishing legitimate deployments from bundled ones. Enabling potentially unwanted application (PUA) protection in Microsoft Defender, along with real-time and behavior monitoring, is advised, deployable via Intune, Group Policy, or PowerShell. Because infrastructure rotates frequently, behavioral detection and correlation of callback parameters with staged filenames and process activity are more effective than domain-based blocking alone.