Fake game downloads secretly monetize Windows PCs
Original title: Microsoft Warns Fake Game Downloads Are Secretly Monetizing Windows PCs
Deceptive installers for games and utilities deliver software that shares bandwidth, runs distributed computing workloads, or installs utilities without informed user consent.
Microsoft reports on a campaign using fake game downloads and cracked software installers to deliver unwanted software including WorldProxyPool for bandwidth sharing, CharityEngine and BOINC for distributed computing, and Advanced Windows Manager utilities. Installers launch temporary processes with Inno Setup, stage additional payloads, and set up persistent scheduled tasks with SYSTEM privileges. Operators track success across multiple offers per bundle.
- Scheduled tasks persist with SYSTEM privileges
- Multiple delivery branches tracked separately
- Unattended installation reduces visible prompts
Impact: unauthorized installation of resource-hijacking software
- 1.Avoid running unofficial game installers and cracked software
- Vendors
- Microsoft
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | beliefdesk.xyz | promise (IoCs):- Type Indicator Associated component Domain beliefdesk[.]xyz Offer callback infrastructure Domain companyharbor[.]xyz |
| domain | companyharbor.xyz | omain beliefdesk[.]xyz Offer callback infrastructure Domain companyharbor[.]xyz Offer callback infrastructure Domain signalpane[.]cfd Off |
| domain | inkact.xyz | omain signalpane[.]cfd Offer callback infrastructure Domain inkact[.]xyz Offer callback infrastructure Domain wishgrove[.]cfd Offe |
| domain | signalpane.cfd | in companyharbor[.]xyz Offer callback infrastructure Domain signalpane[.]cfd Offer callback infrastructure Domain inkact[.]xyz Offer c |
| domain | wishgrove.cfd | re Domain inkact[.]xyz Offer callback infrastructure Domain wishgrove[.]cfd Offer callback infrastructure File path %TEMP%\is-*.tmp\e |
| sha256 | 006510ce1da2b7410376f0788c19e55616eb4bcc30072d25b7d0871dc32aa11c | og , WorldProxyPoolUpdater SYSTEM-level persistence SHA-256 006510ce1da2b7410376f0788c19e55616eb4bcc30072d25b7d0871dc32aa11c Inno second-stage runner SHA-256 21306fc5716f95e252388f9203 |
| sha256 | 21306fc5716f95e252388f920314b42f1c8bcc7df67cb4d39da30217b96f4044 | cc30072d25b7d0871dc32aa11c Inno second-stage runner SHA-256 21306fc5716f95e252388f920314b42f1c8bcc7df67cb4d39da30217b96f4044 Earlier Inno loader SHA-256 72750d32b440e9f2b6d05ff3d218a56 |
| sha256 | 452a210bba4c8d08f7cb7733a816d7220a7fa570a469aea0a997cfc8b594b6a0 | 3258bea145adc0cc6a0f8b1e24c6a8f First-stage payload SHA-256 452a210bba4c8d08f7cb7733a816d7220a7fa570a469aea0a997cfc8b594b6a0 First-stage payload SHA-256 523fb81fae0c7beba7b5171243cc0de |
| sha256 | 523fb81fae0c7beba7b5171243cc0dee7a4d04ae0483be9172eef2394a5a2152 | a7fa570a469aea0a997cfc8b594b6a0 First-stage payload SHA-256 523fb81fae0c7beba7b5171243cc0dee7a4d04ae0483be9172eef2394a5a2152 First-stage payload SHA-256 55cd3d36fdcc58016a64398357b2c97 |
| sha256 | 55cd3d36fdcc58016a64398357b2c9724a060da9f0d09266e537a61ec9552e4f | a4d04ae0483be9172eef2394a5a2152 First-stage payload SHA-256 55cd3d36fdcc58016a64398357b2c9724a060da9f0d09266e537a61ec9552e4f Later staged payload Note: IP addresses and domains are int |
| sha256 | 72750d32b440e9f2b6d05ff3d218a561a75d3d75fb976b461fa59897674a7f70 | c8bcc7df67cb4d39da30217b96f4044 Earlier Inno loader SHA-256 72750d32b440e9f2b6d05ff3d218a561a75d3d75fb976b461fa59897674a7f70 Earlier second-stage runner SHA-256 ab2c2dd37fdcfe1e7620a57 |
| sha256 | ab2c2dd37fdcfe1e7620a57f98c80bd063258bea145adc0cc6a0f8b1e24c6a8f | b976b461fa59897674a7f70 Earlier second-stage runner SHA-256 ab2c2dd37fdcfe1e7620a57f98c80bd063258bea145adc0cc6a0f8b1e24c6a8f First-stage payload SHA-256 452a210bba4c8d08f7cb7733a816d72 |
From the original article
3 min read at cybersecuritynews.com
Fake game downloads and cracked software installers are turning Windows PCs into money-making tools for campaign operators. Microsoft has warned that deceptive installation packages quietly deliver software that shares internet bandwidth, runs distributed-computing workloads, or installs unwanted utilities, often without users understanding what they have agreed to install.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.