SecuFocus
BriefAnnouncements

Fake Windows installers can turn your PC into a proxy or a compute worker

Microsoft describes deceptive downloads that silently add several programs. Blocking the first component does not establish that the whole bundle failed.

By Published on Updated on
Reading time 3 min · Documented analysisGetting started
Generated image: a closed laptop, an unplugged USB drive and a home router on a desk in window light.

Generated image · SecuFocus

At a glance

Key points

A free game, an activator or a cracked plugin may install more than the program you expected. On 3 November, Microsoft described a fake Windows installer campaign that adds software to relay third-party traffic through a PC, use its computing resources or deliver unwanted utilities. If you ran a suspicious download, review the whole installation session and newly created tasks: one blocked component does not prove that the others failed.

One installer can deliver several payloads

The lures Microsoft observed impersonate games, audio plugins, activators and unofficial tools. The user runs the file. An Inno Setup-style wrapper then launches temporary stages and can silently install several components.

The delivery system tracks each payload, which it calls an “offer”, separately. One offer can fail while another installs. A message saying that a file was blocked is therefore not a verdict on the entire session. Inno Setup is a legitimate installer; its presence alone does not identify this campaign.

References[1] Microsoft Security Research: fake-download campaign, analysis dated 3 November 2026

Your connection and processor become monetised resources

Microsoft confirmed a WorldProxyPool branch that installs a network proxy agent and scheduled tasks running as SYSTEM. In the investigated chain, these start the agent at boot, run a watchdog every five minutes and launch an updater hourly.

Another branch installs CharityEngine and BOINC for distributed computing, with supporting components. A third adds AW Manager or Windows Manager. These names alone do not establish compromise: some of the software has legitimate uses. The documented problem is its deceptive installation without the user’s informed knowledge or consent.

References[1] Microsoft Security Research: fake-download campaign, analysis dated 3 November 2026

After running a suspicious file, check more than the download

Microsoft recommends avoiding untrusted sources, enabling potentially unwanted application protection and reviewing unexpected installations. Reputation-based, cloud-delivered and tamper protection in Defender are also among its recommendations. They reduce exposure; they do not certify that a device is clean.

If you ran one of these files, record its source and the approximate time, then have the alerts, added programs and new scheduled tasks reviewed. Do not remove BOINC or VirtualBox solely because the names appear in this research: correlate them with an unwanted installation and the described chain. On a work device, contact support rather than erasing evidence.

  1. Return to the publisher or a verified distribution channel for downloads, without disabling protection to finish an installation.
  2. Check applications and tasks that appeared around the suspicious launch, not only the first blocked file.
  3. Have matching evidence assessed against Microsoft’s published indicators; an isolated filename or domain match remains a lead.
References[1] Microsoft Security Research: fake-download campaign, analysis dated 3 November 2026

Check and explore

Sources for this article

Numbers connect each reference to the passages that use it. Dates show when the documentation was consulted.

This article draws on the sources above. The exercises are for you to try on your devices; SecuFocus does not present them as tests carried out by its editorial team. Interfaces and features can change. Method and corrections.

Cite this article

Keep this reference with the article when you save or share it.