Microsoft Threat Intelligence has discovered a deceptive download campaign that secretly turns Windows computers into revenue generators. The campaign targets individuals searching for cracked commercial software, free games, activators, plugins, and unofficial utilities. Instead of delivering only the promised program, deceptive installers distribute multiple additional packages during a single installation session.
Microsoft identified three monetization branches: WorldProxyPool for routing third-party traffic, CharityEngine and BOINC for distributed computing, and Advanced Windows Manager or Windows Manager for utility-style software installations.
Observed lures included FabFilter, Navicat Premium cracks, Roblox executors, auto-clickers, and game downloads. The delivery system communicates with rotating internet infrastructure to coordinate individual software packages, known as "offers." Requests include recurring parameters such as d=inno and r=offer_execution.
Failed attempts use r=offer_execution_fail. Administrators should investigate staged executables in the Inno temporary folders, correlate offer callbacks with endpoint activity, and examine newly created SYSTEM tasks. Since callback domains frequently change, behavioral signals offer more durable hunting leads than domain matches alone.
Microsoft advises investigating installations of Unexpected WorldProxyPool, BOINC, CharityEngine, or VirtualBox, but the presence of these applications does not automatically indicate malicious deployment. The following indicators of compromise were identified: - Domain: beliefdesk[. ]xyz Purpose: Offer-execution callback infrastructure - Domain: companyharbor[.
]xyz Purpose: Offer-execution callback infrastructure
