Threat Intelligence

Fake Software Downloads Quietly Turn Business PCs into Money-Making Assets for Criminals

Microsoft Security · 4 Nov 2026

Key Takeaway Only allow software to be installed from approved sources, turn on potentially unwanted application protection, and tell staff that cracked software and free activators are a common way to get unwanted programs onto work devices.

Microsoft Threat Intelligence has identified an evolving fake-download campaign aimed at people searching for cracked commercial software, free games, activators, plugins and unofficial utilities. Victims run trojanized installers built in the Inno Setup style. During a single installation, these installers deliver several monetized software payloads, which the delivery system calls "offers".

Microsoft found that the installers track each offer with a callback and status model, recording whether each installation succeeded. Three downstream branches were confirmed. Affected devices were used to route third-party internet traffic, enrolled in a distributed-computing platform, or loaded with extra utility-style software, often without the user's informed knowledge or consent. These products may have legitimate uses, but installing them silently through deceptive bundles creates security and privacy risks.

Observed lures include cracked audio plugins, PC games, Roblox executors, auto-clickers, driver tools and fake utility installers. Examples named by Microsoft include FabFilter Total Bundle, Navicat Premium crack, Command & Conquer: Red Alert 2 and TFT Unlock Tool. Microsoft advises organisations to block untrusted software sources, enable potentially unwanted application protection, and monitor for unexpected software installations and persistence mechanisms. Its full blog also covers advanced hunting queries, MITRE ATT&CK mappings and indicators of compromise.

fake downloads trojanized installers potentially unwanted applications Microsoft Threat Intelligence software piracy

Summarised by CISO AI from Microsoft Security, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.