---
title: Tip: treat cracked-software and unofficial game Inno installers as hostile, and alert on new WorldProxyPool scheduled tasks | ctxsec
url: https://ctxsec.com/items/tip-block-crack-game-innos-worldproxypool-tasks
description: "Microsoft\u2019s campaign turns one lure into proxyware, BOINC/CharityEngine compute, or utility adware. Blocking the lure class and watching for the three WorldProxyPool SYSTEM tasks catches the durable end state even when callback domains rotate."
status: "operational guidance (Microsoft Threat Intelligence, Nov 3)"
published: 2026-11-07
---

> Microsoft’s campaign turns one lure into proxyware, BOINC/CharityEngine compute, or utility adware. Blocking the lure class and watching for the three WorldProxyPool SYSTEM tasks catches the durable end state even when callback domains rotate.

[← Tips & Guides](/tips) · [markdown](/items/tip-block-crack-game-innos-worldproxypool-tasks.md)

operational guidance (Microsoft Threat Intelligence, Nov 3)

2026-11-07

### Tip: treat cracked-software and unofficial game Inno installers as hostile, and alert on new WorldProxyPool scheduled tasks

- Enable cloud-delivered and reputation-based protection / PUA blocking; consider ASR rules that block low-prevalence executables.
- Alert on creation of `WorldProxyPoolAgent`, `WorldProxyPoolWatchdog` or `WorldProxyPoolUpdater`, and on `sdk-agent.exe` under Program Files\WorldProxyPool.
- Software inventory: flag WorldProxyPool, CharityEngine, unexpected BOINC/VirtualBox on endpoints that are not known research hosts.

Sources: [Microsoft Security Blog: fake-download monetization campaign (Nov 3)](https://www.microsoft.com/en-us/security/blog/2026/11/03/fake-download-campaign-uses-trojanized-installers-deliver-monetization-payloads/)