Fake Cracked-Software Installers Turn Windows PCs Into Paid Proxies: WorldProxyPool, BOINC and Adware Pushed Through Inno-Style eld*.exe Chains

Medium · 2026-11-08 · By H.A

Microsoft researchers describe a fake-download campaign where trojanized installers for cracked Navicat, FabFilter and games install WorldProxyPool proxyware, CharityEngine/BOINC and window-manager adware in one session.

Overview

Microsoft Security Research has described a fake-download campaign that turns Windows PCs into money-makers for the operators, not data-theft targets. People looking for cracked commercial software, free games, activators, audio plugins and small utilities get a trojanized installer. That installer tries to place several paid "offers" on the machine in one session: residential proxyware, distributed-computing clients and adware-style "window manager" utilities. The research was published on 3 November 2026.

The victim's bandwidth and processing power are sold without informed consent. On a corporate network, this means unknown third-party traffic leaving through company IP addresses.

The Campaign

Lures. Named lures include cracked Navicat Premium, FabFilter plugin bundles, game installers, activators and auto-clickers. They are spread through fake download pages.

Installer chain. The download behaves like an Inno Setup package. It unpacks a temporary runner into an Inno-style temp folder (%TEMP%\is-.tmp\) and then starts numbered executables such as eld0.exe and other eld.exe files one after another. Each stage tries a separate offer. Some fail and some succeed, and each result is reported to rotating infrastructure through HTTP callbacks with the parameters d=inno and r=offer_execution or r=offer_execution_fail.

Payload branches seen by Microsoft:

• WorldProxyPool proxyware, which routes third-party traffic through the PC. It installs to C:\Program Files\WorldProxyPool\ and creates three SYSTEM scheduled tasks: WorldProxyPoolAgent (at boot, also started immediately), WorldProxyPoolWatchdog (hidden PowerShell every five minutes) and WorldProxyPoolUpdater (hourly).
• CharityEngine / BOINC distributed computing, installed silently with supporting software including VirtualBox. This branch was seen with the FabFilter lure.
• Advanced Windows Manager / Windows Manager, adware-style utilities with components such as AdvancedWindowsManager.exe.

Timeline

• Ongoing through 2026: fake download pages spread the trojanized installers.
• 3 November 2026: Microsoft publishes its analysis with hunting queries and an IOC list for defenders.

Tradecraft

• Pay-per-install economics. One session can deliver several partner payloads, and each success is counted separately through the callback markers. This looks like an affiliate install business, not a single malware family.
• Abuse of legitimate frameworks. Inno Setup, BOINC and VirtualBox are all legitimate software. Their presence alone does not prove infection, which helps the campaign avoid quick verdicts.
• Rotating infrastructure and filenames. Decoy names and domains change often. Microsoft notes that the temp-folder path and numbered filenames are more lasting signals than the lure filename.
• SYSTEM-level persistence with a watchdog task, so the proxy agent comes back if a user kills it.

Indicators of Compromise

Host artefacts named in the research (no hashes or domains are listed here; see the vendor's IOC list):

%TEMP%\is-*.tmp\eld*.exe
%TEMP%\is-*.tmp\set_*.exe
FirstFast[1].exe / SecondRunner[1].exe
C:\Program Files\WorldProxyPool\
Scheduled tasks: WorldProxyPoolAgent, WorldProxyPoolWatchdog, WorldProxyPoolUpdater
AdvancedWindowsManager.exe
HTTP callback parameters: d=inno  r=offer_execution  r=offer_execution_fail

Detection

• Hunt for processes started from %TEMP%\is-.tmp\ that are named eld.exe or set_*.exe. Link them to scheduled-task creation and new software installs within the same few minutes.
• Search proxy and web-gateway logs for outbound requests that contain both d=inno and r=offer_execution.
• Flag unexpected installs of WorldProxyPool, CharityEngine, BOINC or VirtualBox on endpoints that have no business reason for them.
• Microsoft Defender XDR customers can use the published advanced hunting queries. Microsoft says Defender detects and blocks several of the payloads.

A quick PowerShell check on a suspect host:

Get-ScheduledTask | Where-Object TaskName -like 'WorldProxyPool*' | Select TaskName,State
Test-Path 'C:\Program Files\WorldProxyPool'
Get-ChildItem $env:TEMP -Directory -Filter 'is-*.tmp' -ErrorAction SilentlyContinue |
  Get-ChildItem -Filter 'eld*.exe' -ErrorAction SilentlyContinue

Recommended Actions

1. Block downloads of cracked software, key generators, activators and unofficial game installers with web filtering and application control.
2. Turn on potentially unwanted application (PUA) protection, cloud-delivered protection, tamper protection and reputation-based protection in Defender Antivirus.
3. Consider the Attack Surface Reduction rule that blocks executables unless they meet a prevalence, age or trusted-list criterion.
4. If a host is affected, remove all bundled payloads, scheduled tasks and services, not just the original installer. Then rescan and watch for the watchdog bringing the proxy back.
5. Review egress for residential-proxy patterns. Company IP addresses used as exit nodes can get your ranges blocklisted, or tie your organisation to other people's fraud.

Analyst Assessment

This campaign is low on sophistication and high on volume, and it is easy to dismiss as "just adware". The proxyware branch is the real risk. Strangers can send traffic through an enterprise network, which can lead to credential-stuffing attempts, fraud or abuse complaints traced back to corporate addresses. The use of legitimate software and changing lures means signature-based blocking alone will fall behind. The temp-folder execution pattern, the callback markers and new SYSTEM scheduled tasks are the reliable signals to build detections on.