Do Son 
At a Glance
| Malware Family | Trojan:Win64/OfferLoader.DA! wrapper delivering WorldProxyPool, CharityEngine/BOINC, and Advanced Windows Manager |
| Threat Actor | Unattributed pay-per-install affiliate network (tracked via affiliate and offer callback IDs) |
| Target / Victims | Windows users searching for cracked commercial software, game executors, and utilities (exact victim count undisclosed) |
| Delivery Vector | Fake download sites distributing trojanized Inno Setup bundles |
| Key Capabilities | Per-offer HTTP status tracking, residential proxy routing, distributed compute hijacking, SYSTEM scheduled task persistence |
TL;DR
On November 3, 2026, Microsoft Threat Intelligence uncovered a fake-download campaign using trojanized installers to monetize Windows devices. Disguised as cracked software and game utilities, these Inno Setup trojanized installers deploy residential proxy agents, distributed computing software, and adware bundles. Furthermore, the campaign uses a per-offer callback system so remaining payloads still install even if security tools block the first stage.
Delivery and Attribution
The attack targets users looking for free versions of commercial programs, game cheats, and system utilities. Observed lures include Echo Client, FabFilter Total Bundle, Navicat Premium cracks, Command & Conquer: Red Alert 2, Deadpool Apunka Games, TFT Unlock Tool, and Clownfish Voice Changer. According to the Microsoft Threat Intelligence report, “The campaign uses trojanized Inno Setup-style installers to distribute multiple monetized software payloads, referred to by the delivery system as “offers”, during a single installation session.”
Confirmed attribution to a specific named threat group does not exist. However, confirmed telemetry links the operation to a structured pay-per-install affiliate ecosystem. Specifically, the installers transmit affiliate IDs, offer IDs, and download-network parameters to track successful deployments across distribution partners. Suspected attribution points to financially motivated operators who profit by renting out victim bandwidth and processing power. Microsoft did not disclose a total victim count in its advisory.
Infection Chain
When a user runs a downloaded lure, the wrapper extracts an Inno Setup temporary runner inside a folder matching %TEMP%\is-*.tmp\. Next, the runner spawns child processes using command-line flags such as /SL5, /SPAWNWND, and /FIRSTWND. From that temporary directory, the wrapper launches numbered executable stages named eld0.exe through eld5.exe or set_*.exe.
Afterward, the staged payloads execute downstream installers using quiet command-line switches including /qn, /S, /quiet, and /norestart. Consequently, the monetization software installs in the background without displaying setup prompts. Even though some bundled programs have legitimate standalone uses, Microsoft noted that “their silent installation through deceptive software bundles without informed user consent introduces security and privacy risks.”
Command-and-Control and Data-Exfiltration Behavior
During execution, the temporary runner contacts rotating command servers using a fixed query-string structure containing d=inno and r=offer_execution. If an antivirus engine blocks a stage, the runner sends an r=offer_execution_fail message that includes the local error text. Because each offer runs independently within the session, a blocked first stage does not stop subsequent offers from installing.
Three Monetization Branches
Researchers confirmed three primary monetization paths linked to specific offer and download-network pairs. First, offer 1727 installs WorldProxyPool under the Program Files directory to turn the host into a residential proxy exit node. In this branch, the eld4.exe stage creates three SYSTEM-level scheduled tasks: WorldProxyPoolAgent at startup, a hidden PowerShell WorldProxyPoolWatchdog every five minutes, and WorldProxyPoolUpdater every hour.
Second, offer 1720 deploys CharityEngine, Berkeley Open Infrastructure for Network Computing (BOINC), and VirtualBox 7.2.8. This branch hijacks CPU and GPU resources for distributed computing tasks. Third, the eld3.exe stage runs an MSI package named Windows Manager – Postback Johan.msi to install Advanced Windows Manager and Windows Updater adware utilities.
Defense and Detection Guidance
Organizations can block these trojanized installers by restricting downloads from unverified software portals and enabling Potentially Unwanted Application protection in Microsoft Defender. Security teams should hunt for Inno Setup runners spawning numbered eld*.exe binaries from %TEMP%\is-*.tmp\ directories rather than relying on short-lived callback domains.
Additionally, administrators should audit Windows Task Scheduler for unauthorized SYSTEM tasks named WorldProxyPoolAgent, WorldProxyPoolWatchdog, or WorldProxyPoolUpdater. If an infection is confirmed, responders must remove the scheduled tasks, uninstall unexpected programs like WorldProxyPool, BOINC, VirtualBox, and AW Manager, and run a full endpoint scan to clear remaining Inno Setup staging files.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
