Microsoft Warns Fake Software Cracks Install Proxyware, Compute Clients and Adware on Windows

Microsoft confirmed three downstream branches. One routes third-party internet traffic through the victim's machine. One enrolls the machine in a distributed-computing platform. One installs utility-style adware. Microsoft notes that some of these products may have legitimate uses. The problem is that they arrive silently, through deceptive bundles, without the user's informed consent.

The four-stage attack chain​

Microsoft splits the operation into four stages:

1. Fake download lures. Users run installers dressed up as cracked software, PC games, Roblox executors, auto-clickers, driver tools, mobile-unlock tools or audio plugins. Lure names Microsoft observed include Echo Client, FabFilter Total Bundle, Navicat Premium crack, Cue Club, auto-clicker, Deadpool Apunka Games, Command & Conquer: Red Alert 2, TFT Unlock Tool and clownfishvoicechanger. These are bait names. Nothing suggests the real vendors are involved.
2. Inno wrapper and temporary runner staging. The lure starts an Inno Setup-style temporary runner under %TEMP%\is-*.tmp\. The runner then launches numbered stages such as eld0.exe, eld1.exe, eld3.exe, eld4.exe and eld5.exe, along with set_*.exe-style stages.
3. Offer callbacks and payload delivery. The runner contacts rotating infrastructure with randomized URL paths, but the query string keeps the same shape.
4. Silent installation of monetization payloads. Downstream installers run with unattended switches such as /qn, /S, /quiet and /norestart.

How far a session gets varies. In one Echo Client example, the chain went through several numbered stages and reached more than one monetization branch. Other lures showed fewer stages.

Microsoft says lure filenames matter less than the plumbing. The %TEMP%\is-*.tmp\ path, the /SL5, /SPAWNWND and /FIRSTWND arguments, and the numbered stage names are more durable indicators than whatever the fake installer happens to be called this week.

Section summary: The lure names change constantly, but the Inno temp-folder behaviour stays the same. Hunt for the behaviour.

How the offer callbacks work​

Each offer gets its own callback. A successful attempt reports d=inno with r=offer_execution. A failed or blocked attempt reports r=offer_execution_fail, sometimes with local error text. In some cases that text said the operation didn't complete because the file contained a virus or potentially unwanted software, so the operators can see when your antivirus blocked them.

The other parameters Microsoft observed include:

Microsoft is clear that these meanings come from telemetry correlation, not confirmed server-side definitions. Treat them as clues.

Two observed offer/download-network pairs map to specific branches. o=1720 / dn=536 goes with CharityEngine/BOINC, and o=1727 / dn=564 goes with WorldProxyPool. The other pairs Microsoft saw are 1712/507 (a common first-stage offer), 1729/566, 331/244, 1674/440, 1675/441, 1681/447 and 1730/567.

Two caveats matter for defenders:

• One blocked offer doesn't mean the session stopped. Offers succeed or fail independently, so a session can fail one offer and still deliver the next.
• The callback may come too late to prevent anything. In some EDR traces, child payloads launched before or around the r=offer_execution callback. The callback is good for attribution and sequencing, but by then something may already be running.

Branch A: WorldProxyPool proxyware​

This is the branch that should worry admins most. A staged eld4.exe created three scheduled tasks for components under C:\Program Files\WorldProxyPool\. All three run as SYSTEM with highest privileges:

• WorldProxyPoolAgent runs sdk-agent.exe at system startup. The installer also started it right away with schtasks.exe /Run.
• WorldProxyPoolWatchdog runs a hidden, noninteractive PowerShell watchdog script every five minutes.
• WorldProxyPoolUpdater runs sdk-agent.updater.exe update every hour.

Later launches go through the Windows Task Scheduler service (svchost.exe -k netsvcs -p -s Schedule), so the agent and watchdog run in the service context. In the Navicat-lure chain, WorldProxyPool also wrote uninstall metadata under its own registry key.

In plain terms, your PC becomes an exit node for someone else's traffic. On a corporate network, that traffic leaves through your egress IPs. If whatever passes through it causes trouble, the logs point at you first.

Branch B: CharityEngine and BOINC compute hijacking​

The second branch installs distributed-computing software under C:\Program Files\BOINC\ and C:\ProgramData\BOINC\. Components Microsoft observed:

• ce-installer_7.14.2_vbox-7.2.8.exe and ce_7.14.2_windows_x86_64.exe
• charityengine.exe, boinc.exe, boinctray.exe, boinc.scr, boincscr.exe and ce11.exe
• wrapper_2022110901_windows_x86_64.exe
• VirtualBox-7.2.8-r173730.msi

Together these launch BOINC, run compute wrappers, check GPU and compute capability, talk to CharityEngine project infrastructure and install VirtualBox. In the FabFilter-lure chain, Microsoft saw CharityEngine/BOINC, VirtualBox and Visual C++ components installed silently, followed by BOINC workloads and contact with CharityEngine infrastructure.

BOINC itself is well-known, legitimate volunteer-computing software. That's what makes this branch awkward. A help-desk tech who finds BOINC on a machine might assume the user installed it for a science project, when the user never chose it at all. Finding VirtualBox on a workstation where nobody asked for a hypervisor is another useful clue.

Branch C: AW Manager / Windows Manager adware​

The third branch, delivered through the same Inno offer infrastructure, is plain utility-style adware. In one process tree, the runner spawned eld3.exe, which launched Windows Manager – Postback Johan.msi. That installed AdvancedWindowsManager.exe and Windows Updater.exe under paths like %APPDATA%\AW Manager\Windows Manager 1.0.0\ or C:\Program Files (x86)\AW Manager\Windows Manager\.

Watch for "Windows Updater.exe." A file named to look like part of the operating system, sitting in a folder that has nothing to do with Windows Update, is classic masquerading.

Section summary: Proxyware uses your bandwidth and IP address, BOINC uses your CPU and GPU, and AW Manager fills the system with junk. One session can install any combination of the three.

Defender detections Microsoft reports​

Microsoft lists these detections for the campaign:

• Microsoft Defender Antivirus: Trojan:Win64/OfferLoader.DA!MTB, Trojan:Win64/OfferLoader.DB!MTB, Trojan:Win32/OffLoader.A, Behavior:Win32/SuspInnoOffer.A!mapsi and Adware:Win32/Clover
• Microsoft Defender for Endpoint: alerts for suspicious files, active "Wacatac" and "Clover" malware, blocked "Egairtigado," prevented "Kepavll," blocked "SuspInnoOffer," "SuspEtherRpcConn" and "SuspSmsScanConn" behaviours, and several scheduled-task alerts

Not every session will trigger every one of these. Microsoft also points Security Copilot customers to promptbooks such as Incident investigation and Threat Intelligence 360, depending on which data sources are connected.

Hardening Windows: what to switch on​

Microsoft's preventive advice:

• Don't download cracked software, keygens, unofficial game installers or activators.
• Make sure Defender's cloud-delivered protection is on.
• Keep tamper protection on.
• Turn on reputation-based protection.
• Evaluate the Attack Surface Reduction rule that blocks executables unless they meet prevalence, age or trusted-list criteria.

Microsoft also tells organizations to enable potentially unwanted application (PUA) protection, but the advisory doesn't explain how. Microsoft Learn's documentation for evaluating Defender through PowerShell covers it under the heading "Prevent grayware, adware, and other potentially unwanted apps from installing", using Set-MpPreference -PUAProtection Enabled.

The same documentation lists commands that strengthen cloud protection, including Set-MpPreference -MAPSReporting Advanced, Set-MpPreference -SubmitSamplesConsent Always, Set-MpPreference -DisableBlockAtFirstSeen 0. Microsoft explains why this matters for a campaign whose domains rotate so often: "Standard definition updates can take hours to prepare and deliver. Our cloud-delivered protection service can deliver updated malware protection in seconds."

To set up and check PUA protection on a single PC:

1. Open PowerShell or Terminal as administrator.
2. Run Set-MpPreference -PUAProtection Enabled.
3. Check it with Get-MpPreference | Format-Table PUAProtection. According to WindowsForum's own PUA tutorial, block mode is 1, audit mode is 2, and off is 0.
4. If you get 2, you're only logging detections. As that tutorial says, "Audit mode is not equivalent to protection."

On domain-joined fleets, the Group Policy setting is Computer Configuration > Administrative Templates > Windows Defender Antivirus, "Configure protection for potentially unwanted applications." One more catch: with tamper protection on, Set-MpPreference changes may not stick on managed devices, so push the setting from Intune or your management console.

Hunting: what to look for​

Microsoft's investigation guidance:

• Check Inno temp folders. Look for processes under %TEMP%\is-*.tmp\, especially eld*.exe, set_*.exe, FirstFast[1].exe or SecondRunner[1].exe.
• Match up callbacks. Find outbound requests containing d=inno with r=offer_execution or r=offer_execution_fail. Group them by device, time window and the sis or affiliate values, then line them up with process, file and scheduled-task events.
• Audit scheduled tasks. Look for new SYSTEM-level tasks, especially ones that act as watchdogs or updaters.
• Audit software inventory. Look for WorldProxyPool, CharityEngine, BOINC or VirtualBox where nobody meant to install them.

Microsoft's Defender XDR query for staged payloads:

DeviceProcessEvents
| where FolderPath has @"\AppData\Local\Temp\is-"
| where FileName matches regex @"(?i)^(eld[0-9]+|set_[0-9]+|FirstFast(?:\[1\])?|SecondRunner(?:\[1\])?)\.exe$"
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, SHA256

Plenty of legitimate installers also use is-*.tmp folders, so the path alone will produce false positives. The eld/set_ filename regex is what narrows it down. Microsoft also says to check the queries against the current Defender XDR schema before you rely on them.

Callback domains: beliefdesk[.]xyz, companyharbor[.]xyz, signalpane[.]cfd, inkact[.]xyz and wishgrove[.]cfd. Microsoft's hunting query adds orbittrack.cfd, prairielink.cfd, willowbox.xyz, stonestation.cfd, foldlodge.xyz, friendsanchor.xyz, fallport.cfd, wishcourt.cfd, cratebase.cfd and belieftrack.cfd. These domains rotate quickly, and Microsoft says a match on a domain alone is a lead, not confirmation.

SHA-256 hashes Microsoft published:

• 006510ce1da2b7410376f0788c19e55616eb4bcc30072d25b7d0871dc32aa11c: Inno second-stage runner
• 21306fc5716f95e252388f920314b42f1c8bcc7df67cb4d39da30217b96f4044: earlier Inno loader
• 72750d32b440e9f2b6d05ff3d218a561a75d3d75fb976b461fa59897674a7f70: earlier Inno second-stage runner
• ab2c2dd37fdcfe1e7620a57f98c80bd063258bea145adc0cc6a0f8b1e24c6a8f: eld0 first-stage payload
• 452a210bba4c8d08f7cb7733a816d7220a7fa570a469aea0a997cfc8b594b6a0: eld0/eld1 first-stage payload
• 523fb81fae0c7beba7b5171243cc0dee7a4d04ae0483be9172eef2394a5a2152: eld0 first-stage payload
• 55cd3d36fdcc58016a64398357b2c9724a060da9f0d09266e537a61ec9552e4f: later eld2–eld5 payload

MITRE ATT&CK mappings: T1204.002, T1053.005, T1036, T1564.003, T1071.001, T1105 and T1496 (Resource Hijacking).

If you find it on a PC​

Microsoft's advisory doesn't include a remediation procedure. The steps below are general incident-response practice, not instructions from Microsoft:

• Isolate the device.
• Remove all three WorldProxyPool tasks before uninstalling anything. Otherwise the five-minute watchdog can start the agent again.
• Treat the original lure as untrusted, and assume other offers in the same session may also have run.

The bigger picture​

The campaign is more organized than it looks. With affiliate IDs, per-offer reporting and placement slots, it's built like an ad network that happens to deliver its "inventory" through trojanized installers. Because the end products sit in a gray area — proxy SDKs, volunteer-computing clients, junkware — some victims may never realize anything went wrong. They'll just notice the fans running, the bandwidth disappearing, or their IP address landing on someone's blocklist.

The main protections against a campaign like this are free: get software from its real publisher, and set Defender's PUA protection to block mode.