Microsoft finds fake installers monetizing devices three ways
Microsoft Threat Intelligence identified an evolving fake-download campaign that uses trojanized installers to deliver multiple monetization offers in one session, with three confirmed outcomes.
The installer presents itself as one download but manages each offer separately, tracking delivery and installation. The resulting software can route third-party internet traffic through a device, enroll it in distributed computing, or install utility-style software—often without users’ informed consent. These components may have legitimate uses, but their silent installation creates privacy and resource-use risks.
Where users seek cracked software, free games, activators, or unofficial utilities, one session can leave several unwanted installations to account for. A malware-only investigation focused on one familiar payload may miss the other offers and the device uses that persist beyond it.
Fake-download campaign uses trojanized installers to deliver monetization payloads | Microsoft Security Blog
Microsoft Threat Intelligence tracks a fake-download campaign that uses trojanized Inno installers to deliver multiple monetization offers and provides detection and investigation guidance across the complete installer session.