Fake Download Campaign Leverages Trojanized Installers for Monetization Payloads
Microsoft details a fake download campaign using trojanized installers to distribute multiple monetization payloads, posing risks through silent installation of unwanted software.
Microsoft Threat Intelligence has uncovered an evolving fake-download campaign that preys on users searching for cracked software, free games, and unofficial utilities. The campaign employs trojanized installers, often disguised as legitimate software, to deliver a variety of "offers" during a single installation session. These "offers" are essentially monetization payloads designed to transform affected devices into revenue-generating assets for the attackers.
The attack chain begins with users downloading and running these deceptive installers, which are promoted as cracked commercial software, game installers, or essential utilities. Once executed, the installer launches a temporary runner that contacts malicious infrastructure to coordinate the delivery of downstream payloads. This process is managed through a callback and status-tracking model, ensuring that the campaign can monitor installation outcomes and adapt its delivery strategy.
Microsoft has identified three primary monetization branches that these installers lead to. The first involves routing third-party internet traffic through the compromised device via components like WorldProxyPool, effectively turning the user's internet connection into a proxy service. This can lead to privacy concerns and potential misuse of the user's IP address for illicit activities.
A second branch enrolls the device into distributed computing platforms, such as CharityEngine or BOINC. While these platforms have legitimate uses for scientific research, their silent installation and utilization without explicit user consent can consume significant system resources and potentially impact device performance.
The third monetization branch focuses on installing additional utility-style software, often adware or potentially unwanted applications (PUAs), without the user's informed consent. These silently installed programs can lead to intrusive advertising, system slowdowns, and further privacy risks as they may collect user data.
While the individual components delivered by this campaign may have legitimate functions, their deceptive distribution method and silent installation bypass user consent, introducing significant security and privacy risks. Organizations are advised to mitigate exposure by blocking untrusted software sources, enabling protection against potentially unwanted applications, and monitoring for unexpected software installations and persistence mechanisms.
Microsoft Defender provides protection against this activity, and the company has released advanced hunting queries, MITRE ATT&CK mappings, and indicators of compromise to aid defenders in detecting and responding to related threats. The campaign highlights a growing trend of attackers using social engineering and deceptive software distribution to achieve monetization goals, often by exploiting user trust and a lack of security awareness.