On November 3, Microsoft published research on tampered installers targeting people searching for pirated software, games and unofficial utilities. According to its analysis, one installation can trigger several software deliveries and record the outcome of each separately.

Researchers confirmed three monetization paths: routing third-party traffic, adding devices to a distributed-computing platform and installing additional utilities. Microsoft recommends avoiding untrusted download sources, enabling protection against potentially unwanted applications and investigating unexpected installations and scheduled tasks. The report describes observed activity without specifying when the entire campaign began.

Original source

Microsoft Security Research

Fake-download campaign uses trojanized installers to deliver monetization payloads

Research is explicitly attributed to Microsoft; these findings are not presented as independently corroborated by another investigation.

Original CYBERSEC.mx summary based on the linked sources. Refer to the original documents for technical details and updates.