Executive Summary
Microsoft Threat Intelligence has identified an evolving campaign that uses trojanized Inno Setup-style installers to distribute monetized software payloads. The campaign targets users searching for cracked commercial software, games, and utilities. Once executed, the installers use a per-offer callback model to coordinate the delivery of multiple downstream branches, effectively turning victim devices into monetized assets without informed consent.
The attack chain involves four stages: initial access via deceptive lures, staging through temporary runners in the user's temp directory, server callbacks for offer selection, and final payload installation. The three confirmed monetization outcomes include WorldProxyPool (network resource hijacking), CharityEngine/BOINC (compute resource hijacking), and Advanced Windows Manager (adware-style utility installation).
This campaign represents a significant risk to organizational privacy and performance. By abusing system resources for proxy traffic and distributed computing, affected devices may suffer from degraded network speeds and high CPU/GPU utilization, while also providing a foothold for further persistence through SYSTEM-level scheduled tasks.