Fake Software Installers: Microsoft Says Cracked Downloads Hijack Windows PC Bandwidth and Computing Power, and How to Check Yours

Microsoft says fake downloads for cracked software, free games and unofficial tools are installing programs that earn money from a Windows PC by using its internet connection and computing power. It matters to businesses because one employee running one of these installers on a work laptop could put outside internet traffic on your company connection, with no ransom note or obvious sign that anything went wrong.

Microsoft Threat Intelligence published the report on Tuesday, November 3, 2026. It describes an "evolving fake-download campaign" aimed at people searching for cracked commercial software, free games, activators, plugins and unofficial utilities. One trojanized installer can push several paid "offers" in a single installation session, often, in Microsoft's words, "without users' informed knowledge or consent."

This is not a flaw in Windows, so there is no patch to install. The fix is controlling what gets installed and checking what already has been.

What the fake software downloads install

Microsoft confirmed three ways the campaign makes money:

The lures Microsoft named include a Navicat Premium crack, FabFilter Total Bundle, Command & Conquer: Red Alert 2, TFT Unlock Tool and an auto-clicker. It also saw cracked audio plugins, Roblox executors, driver tools and fake utility installers. Those are not only teenagers' downloads. A database tool and audio plugins are things people want for work when a license looks expensive.

How the fake installers work

The victim runs what looks like a normal setup file, sometimes from a polished page with repeated download buttons. An Inno Setup-style installer starts a temporary program under %TEMP%\is-*.tmp\, which launches numbered stages with names like eld0.exe, eld4.exe or set_*.exe. Each offer reports to rotating web domains, and the final installers use unattended switches such as /quiet, /S and /norestart.

Offers can succeed or fail independently, so two infected PCs may not end up with the same software. Microsoft says the temp path and numbered stage names are "more durable indicators than the original lure filename," so searching for one file name will miss most of it.

What is confirmed about the fake installer campaign, and what is not

Confirmed in Microsoft's report: the three branches, the software names, the scheduled tasks and the Defender detections, including Trojan:Win64/OfferLoader and Adware:Win32/Clover. Microsoft also published 7 file hashes and 15 domains across its indicator list and hunting query.

Microsoft's assessment, not established fact: what the tracking fields in the callback addresses mean, such as an affiliate ID. Microsoft bases these on telemetry and says several exact meanings are unconfirmed. It also cautions that "domain-only matches are leads, not confirmation."

Not known: how many devices were affected, how long this has been running, who is behind it, which countries are involved and whether any businesses were hit. Microsoft names no threat actor and does not say the makers of the named products took part, so treat those names as things to look for, not accusations.

Microsoft's report does not describe cryptocurrency mining or password theft. That is silence, not an all-clear for a PC that ran one of these files. The details come from Microsoft's own telemetry, and we did not find an independent technical analysis.

Why fake downloads matter for a company network

Microsoft did not assess business impact, so this part is our reading:

• Your connection carries someone else's traffic. If a proxy agent runs on a company laptop, outside traffic leaves through your internet address, and you do not know what that traffic is.
• Someone else controls what runs next. An hourly updater running with SYSTEM rights means the software on that machine can change without anyone at your company approving it.
• You pay for the resources. Bandwidth, electricity and slower machines are your cost, and the same applies to contractor and home PCs used for work.
• You have to explain it. Unapproved software on a machine that handles customer data is a hard conversation with a client, auditor or insurer.

How to check Windows PCs for fake installer software this week

From an elevated PowerShell window on a single PC:

Get-ScheduledTask -TaskName "WorldProxyPool*"
Test-Path "C:\Program Files\WorldProxyPool"
Get-MpPreference | Format-Table PUAProtection

For the first two, no task and False are what you want. For the third, 1 means unwanted apps are blocked, 2 means audit mode and 0 means off. Audit mode detects but takes no action, and Microsoft documents it as the default on devices not onboarded to Defender for Endpoint with current security intelligence. Check for false positives in audit, then enforce it with Set-MpPreference -PUAProtection Enabled or your management tool.

If you find these programs, we would rebuild the machine rather than trust an uninstaller, because one session can drop several programs.

Fake software installer questions people are asking

Is there a patch for this?

No. Microsoft describes a campaign that relies on people running a fake installer, not a software vulnerability.

What is proxyware?

Software that lets other parties send internet traffic through your device. In this campaign, Microsoft names WorldProxyPool as the proxy component.

Are cracked games and cracked software safe to download?

No. Microsoft specifically says not to download cracked software, key generators, unofficial game installers or activation tools.

How do I know if my PC is sharing bandwidth?

Check for the WorldProxyPool folder and scheduled tasks above. A slow PC or high network use alone proves nothing either way.

Does Microsoft Defender detect these fake installers?

Microsoft lists Defender detections for several stages, including OfferLoader and Clover. That only helps if protection is on and set to act, so confirm the settings.

Do these fake downloads steal passwords?

Microsoft's report does not describe password theft. It also does not say a PC that ran one is otherwise clean.

The bigger lesson

Free software has a business model, even when it is stolen. Nothing in this campaign needed a broken firewall or an unpatched server. It needed one person to run one file, and a PC with the rights to let that file install whatever came next. Decide who can install software on company machines, make the licensed route easy, and check regularly what is actually running.

To lock down what can run on your company PCs, see our security hardening service or request a quote.

Get security alerts by email, with the free checklist, at our security alerts page.

Sources: Microsoft Security Blog, fake-download campaign report; Microsoft Learn, block potentially unwanted applications; Microsoft Learn, ASR rules reference; Microsoft Support, protect your PC from potentially unwanted applications.