Malware · 1 source · latest 2h

Fake software downloads secretly enlist Windows PCs in bandwidth sharing and computing schemes

MALWAREMicrosoftredteam/daily · 1 source

Severity: Medium
Sources: 1

What happened

Microsoft's 3 November analysis describes an Inno Setup-based installer chain that pulls "offers" from rotating callback domains such as beliefdesk[.]xyz and companyharbor[.]xyz. The branches deliver WorldProxyPool proxyware (sdk-agent.exe, with three SYSTEM scheduled tasks), CharityEngine/BOINC/VirtualBox for resource hijacking (cryptomining not established), and Advanced Windows Manager. Defenders should hunt for unexpected SYSTEM scheduled tasks, the %TEMP% is-.tmp staging pattern and the listed hashes, enable potentially unwanted application protection, and evaluate attack surface reduction rules.

For security analysts · Written by AI from 1 source · Wrong?

What to do

Avoid cracked software and unofficial download sources.
Review computers for unexpected scheduled tasks, especially those running as SYSTEM, such as WorldProxyPoolAgent, WorldProxyPoolWatchdog and WorldProxyPoolUpdater.
Enable potentially unwanted application protection and keep cloud-delivered antivirus, tamper protection and reputation-based checks active.
Investigate software that users did not intentionally install and check the listed indicators of compromise.

Written by AI from the sources, checked against them

Read the full story at the source