Malware · 1 source · latest 1h

Fake cracked-software installers secretly turn Windows PCs into proxy and computing nodes

MALWAREMicrosoftredteam/daily · 1 source

Severity: Medium
Sources: 1

What happened

Microsoft reports a campaign delivering trojanised Inno Setup-style installers via fake cracked-software, game and plugin download pages, using HTTP callbacks with d=inno and r=offerexecution or r=offerexecutionfail to track per-offer success. Payloads include WorldProxyPool proxyware with SYSTEM-level scheduled tasks, CharityEngine/BOINC/VirtualBox, and Advanced Windows Manager-related utilities. Defenders should check execution from Inno temp directories (eld.exe, set.exe, FirstFast[1].exe, SecondRunner[1].exe), correlate the callback strings with process and scheduled-task activity, enable cloud-delivered protection, tamper protection and PUA protection, and evaluate ASR rules. IOCs are published by Microsoft.

For security analysts · Written by AI from 1 source · Wrong?

What to do

Avoid downloading cracked software, key generators, activators and unofficial game installers.
Check systems for unexpected WorldProxyPool, CharityEngine, BOINC or VirtualBox installations and investigate any you find.
Organisations should enable cloud-delivered protection, tamper protection and potentially unwanted application protection in Microsoft Defender Antivirus.
Monitor for execution from Inno temporary directories and for unexpected scheduled tasks.

Written by AI from the sources, checked against them

Read the full story at the source