Fake Cracks Are Quietly Renting Out Your Internet Connection

Go looking for a cracked audio plugin, a free game or a Roblox executor and you may come home with three programs you never asked for. Microsoft Threat Intelligence says a fake-download campaign is handing out trojanized Inno Setup installers that run several paid “offers” in one session: proxyware that rents your internet connection to strangers, a distributed-computing client that spends your CPU and GPU, and an adware-style “Windows Manager”. Microsoft names no actor and gives no victim count.

beliefdesk[.]xyz
companyharbor[.]xyz
signalpane[.]cfd
inkact[.]xyz
wishgrove[.]cfd
orbittrack[.]cfd
prairielink[.]cfd
willowbox[.]xyz
stonestation[.]cfd
foldlodge[.]xyz
friendsanchor[.]xyz
fallport[.]cfd
wishcourt[.]cfd
cratebase[.]cfd
belieftrack[.]cfd

%TEMP%\is-*.tmp\eld*.exe
C:\Program Files\WorldProxyPool\sdk-agent.exe
Scheduled tasks: WorldProxyPoolAgent, WorldProxyPoolWatchdog, WorldProxyPoolUpdater
006510ce1da2b7410376f0788c19e55616eb4bcc30072d25b7d0871dc32aa11c (Inno second-stage runner)
ab2c2dd37fdcfe1e7620a57f98c80bd063258bea145adc0cc6a0f8b1e24c6a8f (eld0 first-stage payload)
55cd3d36fdcc58016a64398357b2c9724a060da9f0d09266e537a61ec9552e4f (later eld2-eld5 payload)

Source article: Fake-download campaign uses trojanized installers to deliver monetization payloads
Publisher: Microsoft Threat Intelligence, Microsoft Security Blog (Microsoft Security Research, Jiacen Xu)
Published: Nov. 3, 2026
URL: https://www.microsoft.com/en-us/security/blog/2026/11/03/fake-download-campaign-uses-trojanized-installers-deliver-monetization-payloads/

Executive Summary

Microsoft Threat Intelligence reports an unnamed, financially motivated fake-download operation that targets people searching for cracked commercial software, free games, activators, plugins and unofficial utilities, with lures dressed as products such as FabFilter Total Bundle, Navicat Premium, Echo Client, Cue Club, Command & Conquer: Red Alert 2, TFT Unlock Tool and auto-clicker tools. Microsoft attributes it to no named actor and gives no victim count or geography; Defender detects the loaders as OfferLoader and OffLoader and the adware branch as Clover. The victim runs a trojanized Inno Setup installer, which spawns an Inno temporary runner under %TEMP%\is-*.tmp\, which in turn drops and launches numbered stages (eld0.exe to eld5.exe, or set_*.exe, FirstFast[1].exe and SecondRunner[1].exe) fetched from attacker-controlled, cloud-storage and CDN locations. Every offer the runner executes is reported to rotating .xyz and .cfd domains with a callback carrying d=inno and r=offer_execution or r=offer_execution_fail plus affiliate, offer and download-network IDs, and the payloads install silently. Three monetization branches were confirmed: WorldProxyPool proxyware, installed under C:\Program Files\WorldProxyPool\ with three SYSTEM scheduled tasks including a hidden PowerShell watchdog every five minutes; CharityEngine/BOINC distributed computing with a bundled VirtualBox MSI; and the AW Manager “Windows Manager” adware-style utility. The objective is pay-per-install revenue and resale of the victim’s bandwidth and compute, which exposes the device owner to abuse traffic routed through their IP address. Hunt leads, false positive expectations, Microsoft’s published hunting queries and indicators are detailed below.

ATT&CK chain: Execution → Persistence → Defense Evasion → Command and Control → Impact

Hunt Lead Grid

Offer-Callback Domains and Payload Hash Sweep

Microsoft lists five offer-execution callback domains in its indicator table, beliefdesk[.]xyz, companyharbor[.]xyz, signalpane[.]cfd, inkact[.]xyz and wishgrove[.]cfd, and ten more in its hunting query: orbittrack[.]cfd, prairielink[.]cfd, willowbox[.]xyz, stonestation[.]cfd, foldlodge[.]xyz, friendsanchor[.]xyz, fallport[.]cfd, wishcourt[.]cfd, cratebase[.]cfd and belieftrack[.]cfd. The runner contacts them as each bundled offer runs, so a device that installed a lure typically produces several hits in a short burst. File indicators are seven SHA-256s for the Inno loaders, second-stage runners and eld* stage payloads, listed in the appendix. The detection logic is a retrospective sweep of DNS, proxy and EDR network telemetry for any of the 15 domains, and of EDR file and process telemetry for the seven hashes, using Microsoft’s published query below for Defender XDR environments.

Use DNS resolver logs, web proxy logs and EDR network events, and sweep 90 days, since the domains rotate and the installed proxyware persists long after the lure ran. Scope fleet-wide, with priority on personal or loosely managed devices, student and lab machines, and developer or creative workstations where people install plugins and tools themselves. Blocking the domains is reasonable because they serve no legitimate purpose, but treat the list as perishable; the stable anchors are the callback pattern and the Inno temp-folder stages in the next leads. A hit should open a host review for WorldProxyPool, BOINC/CharityEngine and AW Manager installs rather than being closed as adware, because proxyware turns the device into an exit point for third-party traffic.

DeviceNetworkEvents
| where RemoteUrl has_any ("orbittrack.cfd", "prairielink.cfd", "willowbox.xyz", "stonestation.cfd", "foldlodge.xyz", "friendsanchor.xyz", "fallport.cfd", "wishcourt.cfd", "cratebase.cfd", "belieftrack.cfd", "beliefdesk.xyz", "companyharbor.xyz", "signalpane.cfd", "inkact.xyz", "wishgrove.cfd")
| project Timestamp, DeviceName, RemoteUrl, RemotePort, InitiatingProcessFileName

Published hunting query, reproduced from the source article (Microsoft Defender XDR advanced hunting; validate against the current schema before use).

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Command and Control → T1071.001 (Application Layer Protocol: Web Protocols) (mapping per source article)

Sources: “Fake-download campaign uses trojanized installers to deliver monetization payloads”, Microsoft Threat Intelligence, Nov. 3, 2026, https://www.microsoft.com/en-us/security/blog/2026/11/03/fake-download-campaign-uses-trojanized-installers-deliver-monetization-payloads/ (source article)

Numbered Stages Launching From Inno Temp Folders

The victim runs a lure such as Echo Client.exe from %USERPROFILE%\Downloads\, which starts an Inno Setup temporary runner (Echo Client.tmp) in %TEMP%\is-*.tmp\ with the /SL5= argument and then a child copy with /SPAWNWND= and /FIRSTWND=. That runner drops and executes the offer stages in the same folder: eld0.exe, eld1.exe, eld3.exe, eld4.exe and eld5.exe in the documented session, or set_*.exe, FirstFast[1].exe and SecondRunner[1].exe in others, and those stages then run silent installers with /qn, /S, /quiet or /norestart (eld3.exe launches the Windows Manager MSI, eld4.exe installs WorldProxyPool). The detection logic is a process-creation rule for an executable whose folder path contains \AppData\Local\Temp\is- and whose name matches eld followed by digits, set_ followed by digits, FirstFast or SecondRunner, with an Inno .tmp runner as parent; a companion rule flags msiexec.exe or a setup binary launched by one of those stages with a silent switch.

Use EDR or Sysmon process creation (Event ID 1) with parent and command line, and sweep 90 days. Scope to all Windows endpoints. Don’t alert on is-*.tmp execution alone, which every Inno-built installer produces; the numbered stage names under that parent are the anchor. Hash blocking the stages is a weak control because the builds change, though Defender’s OfferLoader and SuspInnoOffer detections cover known variants. The pattern generalizes to other pay-per-install bundlers that ride Inno Setup. A hit means the bundle ran: identify the original lure file in Downloads, check what each stage installed, and remove the payloads.

DeviceProcessEvents
| where FolderPath has @"\AppData\Local\Temp\is-"
| where FileName matches regex @"(?i)^(eld[0-9]+|set_[0-9]+|FirstFast(?:\[1\])?|SecondRunner(?:\[1\])?)\.exe$"
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, SHA256

Published hunting query, reproduced from the source article (escaping as rendered by the source cleaned up; validate before use).

Hunt Lead Level: 2 (Pro)

ATT&CK: Execution → T1204.002 (User Execution: Malicious File); Command and Control → T1105 (Ingress Tool Transfer) (mapping per source article)

Sources: “Fake-download campaign uses trojanized installers to deliver monetization payloads”, Microsoft Threat Intelligence, Nov. 3, 2026, https://www.microsoft.com/en-us/security/blog/2026/11/03/fake-download-campaign-uses-trojanized-installers-deliver-monetization-payloads/ (source article)

SYSTEM Tasks for Proxyware Nobody Installed

The eld4.exe stage installs WorldProxyPool under C:\Program Files\WorldProxyPool\ (sdk-agent.exe, sdk-agent.updater.exe and watchdog.ps1), writes uninstall metadata to a WorldProxyPool registry key, and registers three scheduled tasks that run as SYSTEM with highest privileges: WorldProxyPoolAgent runs sdk-agent.exe at startup and is also started immediately with schtasks.exe /Run, WorldProxyPoolWatchdog runs a hidden, non-interactive PowerShell watchdog every five minutes, and WorldProxyPoolUpdater runs sdk-agent.updater.exe update every hour; the tasks execute under svchost.exe -k netsvcs -p -s Schedule. The compute branch lands in C:\Program Files\BOINC\ and C:\ProgramData\BOINC\ (charityengine.exe, boinc.exe, boinctray.exe, a VirtualBox 7.2.8 MSI) and starts cell.exe through a wrapper after GPU checks. The detection logic is a task-creation rule (Security Event ID 4698 or EDR scheduled-task events) for task names beginning WorldProxyPool, or any new SYSTEM task whose action is powershell.exe with hidden-window and non-interactive arguments pointing at a .ps1 under Program Files, plus a software-inventory and file-creation check for the WorldProxyPool, BOINC/CharityEngine and AW Manager install paths.

Use Windows Security logs with task auditing enabled, EDR scheduled-task and file telemetry, and software inventory. Sweep as far back as inventory allows, since these tasks persist until removed. Scope all endpoints; on managed corporate fleets any of these products is unauthorized software, and the only expected exception is a deliberate BOINC volunteer install, which you confirm and allowlist per host. Uninstalling the application without deleting the tasks is the wrong fix because the watchdog and updater can bring it back. The watchdog-task pattern generalizes to other proxyware SDKs. Treat a hit as an incident on the device’s network identity: remove the software and tasks, and check egress logs for third-party traffic that left through the host.

Hunt Lead Level: 2 (Pro)

ATT&CK: Persistence → T1053.005 (Scheduled Task/Job: Scheduled Task); Defense Evasion → T1564.003 (Hide Artifacts: Hidden Window); Impact → T1496 (Resource Hijacking) (mapping per source article)

Sources: “Fake-download campaign uses trojanized installers to deliver monetization payloads”, Microsoft Threat Intelligence, Nov. 3, 2026, https://www.microsoft.com/en-us/security/blog/2026/11/03/fake-download-campaign-uses-trojanized-installers-deliver-monetization-payloads/ (source article)

Offer-Execution Callbacks Correlated to Installer Sessions

Each offer the runner executes produces one HTTP callback to the rotating infrastructure with a randomized path and a fixed query structure, ?sis=&fz=&d=inno&r=offer_execution&ko=no&o=&a=&dn=&spot=&t=&cr=, where sis correlates the session, a is the affiliate, o the offer, dn the download network and spot the placement order; failed offers report r=offer_execution_fail, sometimes with a msg value quoting the antivirus error. Microsoft documents offer and download-network pairs such as 1712/507 (primary first stage), 1720/536 (CharityEngine/BOINC) and 1727/564 (WorldProxyPool), and notes that child payloads sometimes launch just before or around the callback. The detection logic groups callbacks matching d=inno and r=offer_execution or r=offer_execution_fail by device and a short time window, extracts the o and dn values to name which offers ran or failed, and joins the window to process events from the same device for an Inno .tmp runner and its numbered stages, so analysts see the whole session: lure, runner, stages, offers and resulting installs.

This needs URL-level telemetry (a proxy or EDR that records full request URLs, as Defender’s RemoteUrl does) joined to process creation, with a per-device window of roughly 30 minutes around the runner start. Sweep 90 days. Expect occasional matches from other bundlers that reuse the string pattern; the join to the is-*.tmp stage processes and the parsed offer IDs are what confirm it. Because the infrastructure rotates, this URL-structure correlation keeps working after the domain list goes stale, and a session showing only offer_execution_fail results tells you the endpoint protection held. Successful offers on a device should feed the removal steps of the previous lead.

DeviceNetworkEvents
| where RemoteUrl has "d=inno"
| where RemoteUrl has_any ("r=offer_execution", "r=offer_execution_fail")
| project Timestamp, DeviceName, RemoteUrl, InitiatingProcessFileName

Published hunting query, reproduced from the source article; Microsoft advises grouping results by device and time window, since each callback is one offer result.

Hunt Lead Level: 3 (Elite)

ATT&CK: Command and Control → T1071.001 (Application Layer Protocol: Web Protocols); Command and Control → T1105 (Ingress Tool Transfer) (mapping per source article)

Sources: “Fake-download campaign uses trojanized installers to deliver monetization payloads”, Microsoft Threat Intelligence, Nov. 3, 2026, https://www.microsoft.com/en-us/security/blog/2026/11/03/fake-download-campaign-uses-trojanized-installers-deliver-monetization-payloads/ (source article)

Hash Appendix

Inno loaders, runners and stage payloads

SHA-256s come from the source article; Microsoft did not publish MD5s or SHA-1s, and OTX AlienVault and VirusTotal were not checked. No hashes were published for the WorldProxyPool, CharityEngine/BOINC or AW Manager components, several of which are distributed software in their own right; detect those by install path and task names rather than hash.

MD5s
(not available)  # Inno second-stage runner
(not available)  # earlier Inno loader
(not available)  # earlier Inno second-stage runner
(not available)  # eld0.exe -> first-stage payload in %TEMP%\is-*.tmp\
(not available)  # eld0.exe / eld1.exe -> first-stage payload in %TEMP%\is-*.tmp\
(not available)  # eld0.exe (variant) -> first-stage payload in %TEMP%\is-*.tmp\
(not available)  # eld2-eld5.exe -> later stage payload in %TEMP%\is-*.tmp\

SHA1s
(not available)  # Inno second-stage runner
(not available)  # earlier Inno loader
(not available)  # earlier Inno second-stage runner
(not available)  # eld0.exe -> first-stage payload in %TEMP%\is-*.tmp\
(not available)  # eld0.exe / eld1.exe -> first-stage payload in %TEMP%\is-*.tmp\
(not available)  # eld0.exe (variant) -> first-stage payload in %TEMP%\is-*.tmp\
(not available)  # eld2-eld5.exe -> later stage payload in %TEMP%\is-*.tmp\

SHA256s
006510ce1da2b7410376f0788c19e55616eb4bcc30072d25b7d0871dc32aa11c  # Inno second-stage runner
21306fc5716f95e252388f920314b42f1c8bcc7df67cb4d39da30217b96f4044  # earlier Inno loader
72750d32b440e9f2b6d05ff3d218a561a75d3d75fb976b461fa59897674a7f70  # earlier Inno second-stage runner
ab2c2dd37fdcfe1e7620a57f98c80bd063258bea145adc0cc6a0f8b1e24c6a8f  # eld0.exe -> first-stage payload in %TEMP%\is-*.tmp\
452a210bba4c8d08f7cb7733a816d7220a7fa570a469aea0a997cfc8b594b6a0  # eld0.exe / eld1.exe -> first-stage payload in %TEMP%\is-*.tmp\
523fb81fae0c7beba7b5171243cc0dee7a4d04ae0483be9172eef2394a5a2152  # eld0.exe (variant) -> first-stage payload in %TEMP%\is-*.tmp\
55cd3d36fdcc58016a64398357b2c9724a060da9f0d09266e537a61ec9552e4f  # eld2-eld5.exe -> later stage payload in %TEMP%\is-*.tmp\

References Appendix

• “Fake-download campaign uses trojanized installers to deliver monetization payloads”, Microsoft Threat Intelligence, Microsoft Security Blog (Microsoft Security Research, Jiacen Xu), Nov. 3, 2026, https://www.microsoft.com/en-us/security/blog/2026/11/03/fake-download-campaign-uses-trojanized-installers-deliver-monetization-payloads/ (source article; chain, payload branches, indicators, Defender detections, ATT&CK table and all three KQL queries)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/