Fake download campaign uses trojanised installers to push monetisation software
- Severity
- Medium
- Sources
- 1
What happened
Microsoft reports an evolving campaign using trojanised Inno Setup-style installers that stage numbered payloads (eld.exe, set.exe) under %TEMP%\is-.tmp\ and call back with d=inno and r=offerexecution, with r=offerexecutionfail on blocked offers. Confirmed branches are WorldProxyPool (proxy monetisation, with SYSTEM scheduled tasks for agent, watchdog and updater), CharityEngine and BOINC (compute monetisation), and Advanced Windows Manager (adware-style utility). Defenders should block untrusted software sources, enable potentially unwanted application protection, and hunt for unexpected installations, the %TEMP% runner paths and the callback pattern, as the article notes these callbacks are not always the earliest prevention point. The article is truncated, so further IOCs and queries are not included here.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Block the use of untrusted software sources, such as cracked software and activator sites.
- Enable potentially unwanted application protection.
- Monitor for unexpected software installations and persistence mechanisms such as scheduled tasks.
Written by AI from the sources, checked against them