Microsoft has warned that fake downloads of games and cracked software are quietly turning Windows computers into money-making tools for the people behind them. In a threat intelligence report published on 3 November 2026, Microsoft Threat Intelligence describes installers that pose as free games, cracked applications, activators and utilities, then silently install extra programs the user never agreed to.

The lures include names such as Echo Client, FabFilter Total Bundle, a Navicat Premium crack, Cue Club, auto-clickers, Deadpool Apunka Games, Command & Conquer: Red Alert 2 and TFT Unlock Tool. People searching for those downloads are offered a trojanised installer, usually built with Inno Setup, which runs through a four-stage chain before delivering what Microsoft calls paid “offers” in a single session.

Microsoft confirmed three ways the campaign profits from an infected machine. One branch installs WorldProxyPool, software that routes other people's internet traffic through the victim's computer, setting up scheduled tasks that run with the highest system privileges. A second branch installs CharityEngine and BOINC, a distributed-computing platform, along with supporting software including VirtualBox, putting the machine to work on computing tasks. A third branch installs adware-style utilities known as Advanced Windows Manager or AW Manager.

A blocked payload does not necessarily stop the rest of the bundle, Microsoft notes, so one antivirus alert does not mean the computer is clean. The findings do not establish cryptocurrency mining, and Microsoft notes that some of the delivered products may have legitimate uses. The problem, it says, is that they arrive silently through deceptive bundles, without the owner's informed consent. Microsoft Defender detects the campaign under names including Trojan:Win64/OfferLoader.DA!MTB. The company's advice is to download software only from trusted sources and to avoid cracked programs, unofficial game installers and activation tools.