Hackers Disguise Malware as Popular Games and Software to Hijack Windows PCs

An evolving fake-download campaign that disguises trojanized installers as popular games, cracked software, and utilities to monetize Windows computers.

Rather than delivering one payload, the operation distributes multiple software “offers” during a single installation session, converting victims’ bandwidth and computing resources into revenue streams.

Microsoft’s November 3 investigation identified three confirmed branches: WorldProxyPool proxyware, CharityEngine and BOINC distributed-computing software, and Advanced Windows Manager utilities.

Although these products or components may have legitimate uses, their deceptive installation without informed consent creates security and privacy risks.

Observed lures included Echo Client, FabFilter Total Bundle, Navicat Premium crack, Deadpool Apunka Games, Command & Conquer: Red Alert 2, and TFT Unlock Tool.

Execution begins when a user launches an installer. An Inno Setup-style wrapper creates a temporary runner beneath %TEMP%\is-*.tmp\, then starts numbered executables such as eld0.exe, eld3.exe, and eld4.exe.

Arguments including /SL5, /SPAWNWND, and /FIRSTWND help identify this execution sequence.

The number of stages varies between sessions. One Echo Client installation reached several monetization branches, demonstrating that a single download can trigger multiple unwanted installations.

Temporary runners contact rotating domains through HTTP requests containing d=inno and r=offer_execution. Session, affiliate, offer, download-network, and placement values coordinate payload delivery and record installation outcomes.

Microsoft observed that, the campaign targets users seeking commercial software cracks, audio plugins, game downloads, Roblox executors, auto-clickers, and mobile-unlock tools.

Windows Users Hijacked

Failed attempts generate r=offer_execution_fail, sometimes accompanied by antivirus or potentially unwanted software error messages.

Crucially, each offer operates independently: blocking one payload does not necessarily stop subsequent offers.

Microsoft also observed child payloads launching before or around execution callbacks. These requests therefore provide useful correlation evidence, but defenders should not assume they represent the earliest opportunity to prevent installation.

Because infrastructure rotates frequently, behavioral detection offers a stronger hunting approach than relying exclusively on individual domains.

Investigators should correlate callback parameters with temporary execution paths, staged filenames, and related process activity.

WorldProxyPool installs components under C:\Program Files\WorldProxyPool\ and establishes three scheduled tasks running as SYSTEM.

Its agent starts at boot, a hidden PowerShell access watchdog executes every five minutes, and an updater runs hourly. The installer also launches the agent immediately, enabling recurring proxy activity.

The CharityEngine and BOINC branch installs distributed-computing components, including boinc.exe, charityengine.exe, compute wrappers, and VirtualBox.

This branch enrolls affected machines into computing infrastructure rather than establishing a confirmed cryptocurrency-mining operation.

The utility branch deploys AdvancedWindowsManager.exe and Windows Updater.exe through a Windows Manager MSI package.

Payload installations use unattended switches such as /qn, /S, /quiet, and /norestart, reducing visible interaction.

Organizations should prohibit untrusted software sources, investigate unexpected installations, and review scheduled tasks associated with these components.

Software inventory checks should cover WorldProxyPool, CharityEngine, BOINC, VirtualBox, and AW Manager while distinguishing authorized deployments from bundled installations.

Microsoft recommends enabling potentially unwanted application protection, which can block detected files and installation attempts, then quarantine them.

Its guidance explains deployment through Intune, Group Policy, and PowerShell.

Administrators should also maintain Defender real-time and behavior monitoring. Microsoft’s configuration documentation details policy settings for both capabilities, providing a practical companion to campaign-specific hunting and investigation across affected Windows endpoints.

Indicators of compromise

Indicator	Type	Component
beliefdesk[.]xyz	Domain	Offer-execution callback infrastructure.
companyharbor[.]xyz	Domain	Offer-execution callback infrastructure.
signalpane[.]cfd	Domain	Offer-execution callback infrastructure.
inkact[.]xyz	Domain	Offer-execution callback infrastructure.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.