Trojanized Inno Setup Installers: Microsoft Analyzes Campaign
Microsoft analyzed a campaign in which trojanized Inno Setup installers from unofficial sources secretly deploy proxyware, distributed computing tools, or adware.
On November 3, 2026, Microsoft Threat Intelligence warned about a campaign using trojanized Inno Setup installers when downloading cracked commercial software, games, activators, plugins, and unofficial utilities. According to the analysis, the modified installers secretly deliver additional software intended to monetize the compromised device.
This does not involve the exploitation of a specific vulnerability in Windows or Inno Setup. The campaign relies on social engineering: the user downloads and runs an unofficial installer, while the subsequent components may not be part of the expected installation or deployed with the user’s informed consent.
Trojanized Inno Setup Installers and a Multi-Stage Chain
In the samples, Microsoft observed a multi-stage flow that works with temporary Inno Setup files in the %TEMP%\is-*.tmp\ directory. The monitored traces include eld*.exe or set_*.exe processes launched from this location.
The installers also communicated through HTTP callbacks with the parameters d=inno and r=offer_execution. Microsoft states that the exact meaning of several server-side parameters has not been confirmed. Therefore, according to the company, a match on a domain or filename alone is not sufficient to confirm a compromise. During an investigation, it recommends correlating these traces with the execution of the Inno installer, network communication, and persistence mechanisms.
Three Observed Monetization Methods
Microsoft confirmed three subsequent deployment branches. The first is WorldProxyPool, which uses the device’s network resources through a proxy. The second consists of CharityEngine and BOINC, components for distributed computing. The third branch comprises AW Manager and Windows Manager, which Microsoft characterizes as software focused on adware.
In the analyzed chain, WorldProxyPool created scheduled tasks with system privileges. These involved launching the agent, monitoring its operation, and updating it. The specific task names administrators should check include WorldProxyPoolAgent, WorldProxyPoolWatchdog, and WorldProxyPoolUpdater.
The risk primarily affects devices on which users run unofficial or cracked installers. Such systems may subsequently provide computing power or network connectivity to third parties without the user’s knowledge. Persistence may occur through tasks launched with SYSTEM privileges.
What Users and Administrators Can Check
Microsoft recommends blocking untrusted software sources and checking for unexpected installations. Particular attention should be paid to the presence of WorldProxyPool, CharityEngine, BOINC, VirtualBox, AW Manager, or Windows Manager if their deployment was not expected.
For organizations, Microsoft published indicators of compromise, detection names, and hunting queries for Microsoft Defender XDR. During checks, it is advisable to look for a combination of temporary Inno Setup files, the listed processes, HTTP callbacks, and new scheduled tasks—not an isolated indicator.
The published analysis does not yet include data on the campaign’s scope, the number of victims, its geographic focus, or the specific actor. Further findings may reveal new infrastructure variants or add to the attribution.
Sources
- Microsoft Security Blog – Primary technical analysis of the campaign, its observed payloads, persistence, indicators of compromise, detections, and recommended mitigations.
Verified and updated: 11/04/2026 06:23
