Fake-download trojanized Inno installer campaign: Windows users — monetization payloads via cracked-software lures (no CVE)
Severity: medium · Patch status: no-fix-needed · Since 2026-11-03
Microsoft Threat Intelligence reported a fake-download campaign delivering trojanized Inno Setup-style installers lured as cracked software, games, Roblox executors, activators, and utilities. Installers stage numbered eld/set executables under %TEMP%\is-.tmp\, contact rotating infrastructure via a d=inno / r=offerexecution callback, and silently install monetization payloads: WorldProxyPool (traffic proxying with SYSTEM scheduled tasks), CharityEngine/BOINC (distributed computing), and Advanced Windows/Windows Manager adware-style utilities. Affected devices become monetized assets without informed consent. No CVE; mitigation relies on avoiding untrusted download sources, enabling PUA protection in Microsoft Defender, and monitoring for unexpected installs and persistence. Reported 2026-11-03.
What to do
- Block and warn users against downloading cracked software, activators, and unofficial utilities
- Enable potentially unwanted application (PUA) protection in Microsoft Defender and enforce SmartScreen
- Hunt for %TEMP%\is-*.tmp\ runners, eld*.exe/set_*.exe stages, and d=inno/r=offer_execution callbacks
- Audit for unexpected scheduled tasks (SYSTEM-level watchdog/updater) and unfamiliar installed software like BOINC or proxy agents
- Review Microsoft's published IOCs and advanced hunting queries and map detections to the provided MITRE ATT&CK techniques
Sources
All live incidents on Threat Watch
