Malware News Microsoft Warns Fake Game Downloads Are Secretly Monetizing Windows PCs

[Brownie2019]

Content source

https://cybersecuritynews.com/microsoft-warns-fake-game-downloads/

Fake game downloads and cracked software installers are turning Windows PCs into money-making tools for campaign operators.

Microsoft has warned that deceptive installation packages quietly deliver software that shares internet bandwidth, runs distributed-computing workloads, or installs unwanted utilities, often without users understanding what they have agreed to install.

The campaign targets people searching for free games, software activators, audio plugins, and unofficial tools. Unlike the password theft seen in fake game download campaigns, this operation focuses on making money from installed software and device resources.

A single installer can attempt several installations, giving operators multiple opportunities to profit from one download.

Microsoft Threat Intelligence researchers identified the campaign and detailed its behavior in a November 3 technical report.

Their investigation confirmed three delivery branches involving WorldProxyPool, CharityEngine and BOINC, and Advanced Windows Manager.

These products can have legitimate uses; the security concern is their installation through deceptive bundles without informed consent.

Microsoft Warns Fake Game Downloads

Read full Story:

Microsoft Warns Fake Game Downloads Are Secretly Monetizing Windows PCs

Fake game downloads secretly monetize Windows PCs by installing bandwidth-sharing software and unwanted utilities.

cybersecuritynews.com

 

[Bot]

Read full Story: (link omitted)

Hi Brownie2019, the most important detail here is the multi-offer installer model. Microsoft found that each fake Inno-style installer can attempt several independent payload installations. Blocking one component—or seeing one failed callback—does not establish that the rest of the installation session was harmless.

The three confirmed branches have different consequences:

• WorldProxyPool: turns the PC into a proxy endpoint so third-party traffic can leave through the victim’s residential IP address. Besides bandwidth use, that can damage the IP’s reputation or associate it with someone else’s activity. Microsoft observed SYSTEM-level startup, watchdog and updater tasks.
• CharityEngine/BOINC: consumes computing resources through distributed workloads, potentially affecting performance, electricity use and hardware temperatures.
• Advanced Windows Manager/Windows Manager: installs utility-style software associated with advertising and affiliate-driven distribution.

BOINC, VirtualBox and similar components are not malicious merely because they exist. The problem is deceptive, unattended installation without informed consent; a user who intentionally installed BOINC has not thereby found evidence of this campaign.

Microsoft’s original technical report recommends cloud-delivered Defender protection, tamper protection and reputation-based protection, as well as avoiding cracks, activators and unofficial installers. PUA blocking is especially relevant because some monetization software occupies the awkward territory between legitimate software and outright malware.

If someone only downloaded such an installer but did not execute it, deleting or quarantining it and running a scan is generally appropriate. If it was executed, simply uninstalling the most visible program is not enough because other offers may have succeeded independently. Disconnect the PC from the network, avoid sensitive activity on it, and open a free malware-removal case using Get help so the whole installer session, persistence and unexpected software can be checked.

Sources

• Fake-download campaign uses trojanized installers to deliver monetization payloads | Microsoft Security Blog

 

[TairikuOkami]

Honestly, I feel sorry for all those noobs, like I used to be, all it takes is a good DNS, blocking .xyz is basics. You would never ever connect to a domain like .cn or .xyz

Top Abused TLDs Report: Abuse Rate by Domain Zone | NetAPI

TLD abuse rate report: compromised vs. active domains. Top 100 zones by abuse rate or popularity, updated daily.

netapi.com