Microsoft has published new threat intelligence warning that a wide-reaching campaign is disguising unwanted software as free games, cracked applications, and utility tools, turning ordinary Windows PCs into quiet revenue generators for whoever controls the installer. Rather than stealing passwords, as many fake-download campaigns do, this operation profits by sharing a victim’s bandwidth, running distributed-computing workloads, or dropping unrequested utility programs, often without the user understanding what they actually agreed to.

One download, multiple ways to monetize

Microsoft Threat Intelligence researchers detailed the campaign in a report published November 3, identifying three distinct delivery branches it tracks under the names WorldProxyPool, CharityEngine/BOINC, and Advanced Windows Manager. Each of these products can have entirely legitimate uses on their own; the problem Microsoft flags is that they’re being silently bundled into installers and activated without informed user consent.

The campaign targets people searching for things like PC games, Roblox executors, auto-clickers, driver tools, and software activators, the kind of searches that routinely lead to unofficial download sites. Once a victim runs the installer, it launches temporary processes built around the legitimate Inno Setup installer framework, then triggers additional executable stages that quietly deliver whatever bundled software the operators have configured for that session. A single installer run can attempt several separate installations, giving the operators multiple chances to profit from one unsuspecting download.

How the delivery system tracks its own success

What stands out in Microsoft’s findings is how methodically the operation is run. The delivery system refers to its downstream payloads as “offers” and tracks the outcome of each one independently using session, affiliate, and offer identifiers, essentially an affiliate-marketing structure repurposed for unwanted software distribution. Crucially, if one offer in the bundle fails to install, that doesn’t stop the others. The system is built so that a partial failure doesn’t interrupt the overall monetization chain, and some payloads reported back to their command infrastructure before or during installation rather than only after completion, which Microsoft notes makes some detection checkpoints incomplete pictures of what actually ran.

Three branches, three kinds of abuse

• WorldProxyPool (bandwidth sharing): This branch quietly routes third-party internet traffic through the infected machine. In Microsoft’s investigation, a scheduled task launched the proxy agent at system startup, ran a hidden PowerShell watchdog process every five minutes to keep it alive, and checked for updates hourly, all running with SYSTEM-level privileges.
• CharityEngine and BOINC (distributed computing): This branch installs volunteer-computing software alongside supporting components including VirtualBox, and performs hardware-capability checks before communicating with CharityEngine’s infrastructure. Microsoft is careful to note this constitutes unauthorized resource hijacking, but its findings do not establish that cryptocurrency mining specifically is taking place, an important distinction since the two activities consume device resources differently.
• Advanced Windows Manager (unwanted utilities): The third branch installs utility and “Windows Manager” style applications along with their own updater components, adding to the pile of unrequested software running on the victim’s machine.

Across all three branches, the installers favor unattended installation modes that minimize the prompts a user would see, meaning most victims never get a clear moment to decline what’s being installed.

What it adds up to for victims

The end result isn’t necessarily one single obvious piece of malware sitting on the system. It’s a collection of unexpected applications and recurring background processes, consuming bandwidth, CPU cycles, and startup time, that can persist well beyond the original download session that introduced them. For everyday users, the practical symptoms are a slower PC, unexplained network activity, and software they never remember installing.

Detection and protection guidance

Microsoft’s core advice is straightforward: avoid cracked software, unofficial game installers, and third-party activation tools altogether, and keep cloud-delivered protection, tamper protection, and reputation-based filtering enabled in Windows security tooling. The company’s unwanted-software protection guidance also explains why these programs deserve scrutiny even when they fall short of being classified as outright malware.

• Avoid downloading games, activators, or utility tools from unofficial or third-party sites; stick to official stores and vendor websites.
• Periodically review installed applications and scheduled tasks for unfamiliar entries, especially ones set to run at startup with elevated privileges.
• Watch for unexplained increases in network usage or background CPU activity, which can indicate bandwidth-sharing or distributed-computing software running silently.
• Organizations should include software inventory reviews in routine endpoint audits, since users may install these bundles without realizing what they agreed to.
• Security teams investigating a potential infection should correlate installer execution with network callbacks, newly created scheduled tasks, and unexpected new software, the pattern Microsoft used to identify this campaign.

Microsoft’s report also includes indicators of compromise, including command-and-control domains tied to the offer-callback infrastructure, which defenders can use to hunt for this specific campaign within their own environments.