Follow the Access · 15 — The Fake Installer: Poisoning the Search for Software Itself

Follow the Access — Case 15. This register follows the intruder from the login prompt to the foothold's fate, and closes each case on what the access becomes: RANSOMED · MINED · PROXIED · HARVESTED · WIPED · RESOLD.

Consider the most ordinary act in computing: you need a piece of software, so you search for it, find the download, and install it. Everyone does this constantly, without a second thought, because acquiring the tools you need is fundamental to using a computer at all. This case is about an attacker who poisons that exact act. He does not send you a lure or poison a site you already visit; he waits at the moment you go looking for software, and arranges that when you search for a legitimate program, the result you click leads not to the real download but to a trojanized copy. You wanted the software. You went to get it. And the search itself handed you the poison.

The vector has two engines, and both aim at the same target: the position a user clicks when searching for software. The first is malvertising — the attacker buys legitimate online advertising, impersonating a popular software brand, so that a paid ad leading to a trojanized installer sits at the very top of the search results, above the genuine download. The second is SEO poisoning — the attacker games search-engine rankings so that a malicious site impersonating the software climbs to the top of the organic results. By ad or by ranking, the attacker occupies the spot the user's instinct clicks first, and the user's own reasonable habit — click the top result for the thing I searched for — carries them into the trap. The advertising and search ecosystems, built to connect people with what they want, are turned into a channel for delivering what they do not.

So the disposition is MINED, because the signature payload of this channel — especially through its most reliable lure, the cracked or free version of paid software — is the cryptominer. The victim, often a home user or gamer with a powerful processor, searches for a program, downloads a poisoned installer, gets the software they wanted (it usually works, to avoid suspicion), and, riding in alongside it, a miner that quietly turns their machine into a mining rig. This is the case about poisoning the search for software itself, and about how the register's oldest crime — cryptojacking, first seen at a default-password router — reaches a new victim through the search bar.

1. Attacking the Moment of Acquisition

Begin with what makes this vector distinct, because it attacks a moment the earlier cases left untouched: not a machine sitting exposed, not an inbox receiving a lure, not a site the victim habitually visits, but the specific act of going out to acquire software. This is a moment of genuine need and genuine intent — the user actually wants a program and is actively looking for it — and that intent is exactly what the attacker exploits. He does not have to create desire or manufacture trust in an unexpected message. The desire is already there; the user has decided to get the software and is searching for it. The attacker only has to be waiting where the search leads.

This changes the psychology of the attack in the attacker's favor. In phishing, the victim must be persuaded to act on something unsolicited, overcoming their suspicion of the unexpected. Here there is nothing unexpected: the user initiated the whole interaction, searched for the software, and is looking at results for exactly the thing they wanted. When one of those results is the attacker's, it does not trigger suspicion, because it is a plausible answer to the question the user just asked. The user is not reacting to an intrusion; they are pursuing a goal, and the poisoned result is dressed as the fulfillment of that goal. The attack rides the victim's own intent, which is far more powerful than any lure, because the victim is already moving in the attacker's direction — they just need to be nudged onto the poisoned path, and the poisoned path is sitting at the top of their results looking like the right one.

The consequence is that the vector defeats a certain kind of care. A user who has learned not to click links in emails, not to trust unexpected attachments, not to fall for phishing, has built defenses aimed at unsolicited approaches. But searching for software and clicking a top result is not an unsolicited approach — it is the user's own deliberate action, taken in pursuit of a legitimate goal, and their anti-phishing instincts have nothing to say about it. The fake installer attacks through the gap between "distrust what comes to you" and "trust what you go looking for," and that gap is wide, because you cannot function if you distrust the results of your own searches. The vector's genius is that it does not fight the victim's caution; it operates in the blind spot the caution leaves, at the moment the victim is not defending against an attack but simply trying to get something done.

2. Malvertising and SEO Poisoning — Owning the Click

Now the two mechanisms in detail, because they are the machinery that puts the poison where the click lands, and they exploit the very systems designed to help users find things. Malvertising is the simpler and, in some ways, the more insidious, because it uses paid, legitimate advertising. The attacker goes to a search or display advertising platform and buys ads — real ads, purchased through the normal system — that impersonate a popular software brand. When a user searches for that software, the search engine does what it is built to do: it shows the paid ads first, at the very top, above the organic results. So the user searching for a legitimate tool sees, in the most prominent position on the page, an ad that looks like the official download, with the right brand name and a plausible URL — and it leads to a trojanized installer. The user's reasonable instinct to click the first, most prominent result routes them directly to the attacker, and the search engine's own monetization mechanism delivered them there.

SEO poisoning achieves the same placement by a different route: instead of buying the top spot, the attacker games the rankings to earn it. Search engines rank pages by complex signals of relevance and authority, and attackers manipulate those signals — building networks of fake or compromised websites, stuffing them with the right keywords, cross-linking them to fake authority, and optimizing them for high-value software search terms — until a malicious impersonating page climbs into the top organic results. Where malvertising rents the position, SEO poisoning captures it, and the result is identical: when the user searches, a poisoned download page is sitting among the top results, in the zone the user trusts most, indistinguishable at a glance from a legitimate answer.

What both mechanisms share is the exploitation of the user's rational trust in placement. Users have learned, correctly, that the top results of a search are usually the most relevant and trustworthy — that is the whole value of a search engine, and it is usually true. The fake-installer vector weaponizes that learned trust by buying or gaming its way into the trusted position, so that the signal the user relies on to find good software (it is ranked at the top) is precisely the signal the attacker has counterfeited. The user is not being foolish; they are using the search engine exactly as intended, trusting the results it surfaces, and the attacker has corrupted the results. This is why the vector is so effective against ordinary, reasonable people: it does not require them to do anything careless, only to trust the top of their search results — which is what search results are for.

3. The Pirate's Lure — Something for Nothing

Now the most reliable variant, because while the vector works against anyone searching for software, it works most dependably against those searching for a specific kind: free or cracked versions of software that costs money. This is the pirate's channel, and it is the fake installer's most potent form, for reasons that are as much about the victim's psychology as the attacker's technique.

The mechanism is straightforward. A user wants an expensive program — a professional design suite, a productivity tool, a game — but does not want to pay for it, so they search for a cracked copy, a keygen, a "free download," a pirated version. The attacker is waiting there, because these searches are trivially easy to poison: there is no legitimate result to compete with (the real vendor does not offer a free crack), so the attacker's malicious download is not impersonating a genuine option but is the entire supply. The user downloads the "crack," and it delivers malware — alongside, or instead of, the promised software. Kaspersky documented spoofed installers as a delivery method years ago; the modern pirate-software ecosystem has industrialized it into a reliable, high-volume malware channel.

What makes the pirate lure so effective is the victim's own compromised position, which the attacker exploits with precision. A person seeking to pirate software is, by definition, already willing to do something they know they should not, from a source they know is not official — so their guard, already lowered to acquire the illicit software, offers little resistance to the malware riding along with it. They will not scrutinize the source, because they know the source is a pirate site and expected nothing better. They will not question why the installer wants elevated permissions, because cracks often do. And critically, they will not report the infection or seek help, because doing so means admitting they were pirating software — so the attacker's victims stay silent, and the channel operates with near-total impunity. The lure is the user's own desire for something for nothing, and it is potent because it recruits the victim into their own compromise: they came looking to take something without paying, and the attacker simply charged a different price. The pirate lure is where the fake-installer vector converts a moral shortcut into a machine compromise, against a victim uniquely disinclined to notice or complain.

4. MINED — The Free-Software Seeker's Machine

Now the disposition, and the fake installer earns MINED because its signature payload — especially through the pirate channel — is the cryptominer, and its victims are ideal mining stock. The register's oldest crime returns here, reached through a new door.

Consider who the victim is and what they have. The person installing cracked professional software or a game crack is very often a home user or a gamer, and such users frequently have powerful hardware — capable CPUs and GPUs, bought for gaming or creative work — that is exactly what a cryptominer wants. They keep their machines running, sometimes around the clock. And they are unlikely to scrutinize their computer's behavior: a gamer whose machine runs hot and loud assumes it is the game, not a miner; a home user rarely watches their CPU utilization. This is a near-perfect population for cryptojacking: powerful processors, long uptime, low scrutiny, and — through the pirate channel — a victim disinclined to investigate or report anything. So the fake installer's dominant payload is a cryptominer, typically an XMRig-based one, bundled with the software the user wanted. The honeypot beneath these words confirms the destination even through its different door: its single most common captured malware family is the XMRig-based RedTail miner, exactly the payload this channel delivers.

The installer's cleverness is that it usually delivers the goods. To avoid suspicion, the trojanized installer often really does install the software the user was looking for — the crack works, the program runs, the user is satisfied and moves on, never suspecting that a miner was installed alongside it. From the victim's perspective, they searched for software, downloaded it, installed it, and got what they wanted; there is no obvious sign of compromise, because the visible outcome was success. Meanwhile the bundled miner runs quietly in the background, consuming the machine's CPU, converting the victim's compute and electricity into Monero for the operator, for as long as the machine stays infected — which, given the victim's low scrutiny, can be a very long time. The disposition is MINED because the fake installer, in its dominant form, is a cryptojacking delivery system aimed at a population selected for its mining value: people who wanted free software, installed it on capable machines they keep running, and will not look closely at why the computer is warm.

This closes a loop the register opened at its very first case. Case 01 mined a default-password router — a low-value box taken by the absence of a lock. Case 15 mines a powerful personal computer — a high-value machine taken by the presence of a desire, the desire for free software. Both end in the same place, a miner quietly converting someone else's compute into cryptocurrency, but they arrive by opposite doors: one through a machine that trusted its factory password, the other through a person who trusted their search results. The register's oldest crime is also one of its most adaptable, and the fake installer is proof that cryptojacking will reach whatever machine it can, whether the door left open is a default credential or a poisoned search for a free program.

5. The Source Is the Vendor, Not the Result

The register owes the defense, and the fake installer has an unusually clean one, because the vector depends on the user trusting the wrong thing — the search result — and the fix is to trust the right thing: the source. The defense is behavioral, specific, and highly effective.

The core rule is: acquire software from its official source, not from a search result. When you want a program, go to the vendor's known website directly — type the address you know, or use the official app store for your platform — rather than searching for the software and clicking whatever appears at the top. This single habit defeats both malvertising and SEO poisoning, because it bypasses the poisoned position entirely: the attacker occupies the top of the search results, and if you never rely on the search results to find the download, the attacker's investment in that position buys them nothing against you. Where searching is unavoidable, be specifically wary of paid ads — the sponsored results at the very top are the malvertising slot, and a growing recommendation is to scroll past them to the genuine organic result or, better, the vendor's known domain. Verify downloads by checksum or signature where the vendor provides them, so that a tampered installer fails verification. And treat "free" or "cracked" versions of paid software as almost certainly malicious — this is the hardest advice to make people follow, because it asks them to forgo something they want, but it is the single most reliable protection, because the pirate channel is the vector's most dependable delivery.

Technically, two controls close most of what behavior misses. Ad-blocking removes the malvertising slot outright — if the poisoned ad never renders, it cannot be clicked — which is one reason ad-blockers are, in effect, a security control and not merely a convenience. And endpoint protection with application control blocks the bundled payload from executing, so that even a downloaded fake installer cannot deliver its miner. Together, the behavioral and technical defenses are strong, because the vector's whole premise is defeated by a single principle: the search result is not the source. The search engine surfaces results; the attacker can occupy those results; therefore the results cannot be trusted as the authority on where to get software. The authority is the vendor, reached directly. A user who internalizes that — who goes to the source rather than the result — has closed the door this vector depends on, and the attacker's ads and gamed rankings, however prominent, lead only to a user who was never going to click them.

6. The counter-narrative, steelmanned

The strongest objection to this case is that it blames victims for their own greed and describes a self-inflicted problem — that people who pirate software or click ads get what they deserve, and a threat register should study attacks on the innocent, not the consequences of the careless.

The argument runs like this. The vector's most reliable form preys on people trying to steal software, and its other form preys on people too lazy to type a vendor's address — in both cases, the objection goes, the victim's own bad behavior (piracy, carelessness) is the proximate cause, and dressing it up as a sophisticated "vector" excuses conduct that is at best negligent and at worst theft. Real victims, the argument continues, are the targets of attacks they could not have avoided; the fake-installer victim chose to search for a crack or click a sponsored ad, and the lesson ("don't pirate software, go to the official source") is both obvious and moralizing. On this view the case is a lecture about not stealing software, wearing the costume of threat intelligence.

The register grants the self-infliction in the pirate case and rejects the dismissal for the whole. Yes, the pirate channel preys on people seeking to pirate, and the case says so plainly, even analyzing how the victim's compromised position aids the attacker — that is honest analysis, not exculpation. But the objection wrongly narrows the vector to its pirate form. Malvertising and SEO poisoning also route users searching for entirely legitimate, free, official software to trojanized copies — a person searching for a real, free, open-source tool, or the official installer of a popular application, can be led to a poisoned download by an ad or a gamed ranking, through no fault beyond trusting the top of their search results, which is what search results are for. That victim is not a pirate and not careless in any meaningful sense; they used the search engine exactly as designed and were betrayed by a corrupted result. Reducing the case to "don't pirate" ignores this large, innocent victim population. And even for the pirate victims, the register's stance is its consistent one: we record what the vectors do without moralizing about the victims, because the cryptojacking of a pirate's machine is still a real crime committed by a real attacker, and understanding the channel protects the non-pirates who use it too. The lesson is not "stealing software is wrong" (true but not the point); it is the specific, useful principle that the search result is not the source — which protects everyone who acquires software, pirate and saint alike. The case earns its place by documenting how the ordinary act of getting software was turned into an attack surface, which is a fact about the internet, not a judgment about the user.

7. Disposition — MINED

Case 15 followed the fake installer — the malvertising and SEO-poisoning vector that attacks the moment a user goes looking for software. By buying impersonating ads that sit above the real download, or gaming rankings so a malicious page tops the results, the attacker occupies the position the user clicks when searching for the tool they want, and the user's own reasonable habit — trust the top result — carries them to a trojanized installer. The most reliable form is the pirate's lure, where users seeking free or cracked software are routed to poisoned downloads against which their already-lowered guard offers no resistance, and their reluctance to report leaves the channel operating with impunity.

The disposition — the foothold's fate — is MINED, because the channel's signature payload is a cryptominer bundled with the software the user wanted, and its victims are ideal mining stock: home users and gamers with powerful CPUs, machines kept running, and little inclination to question why the computer is hot. The installer usually delivers the real software too, so the victim sees only success while the miner quietly converts their compute to Monero. The honeypot confirms the destination through its different door: its most common captured payload is the very XMRig-based miner this channel delivers. It closes the loop the register opened at Case 01 — cryptojacking a router through an absent lock there, cryptojacking a powerful PC through a poisoned search here — the oldest crime reaching whatever machine it can, by whatever door is open.

The defense is clean and behavioral: the search result is not the source. Acquire software from the official vendor or app store reached directly, scroll past the sponsored slot, verify signatures, treat "free" and "cracked" as malicious, and let ad-blocking remove the malvertising position and endpoint control block the payload. The vectors do not lie: the user wanted a program, searched for it, trusted the top result the way search has taught everyone to, and installed a miner alongside the software they came for — the machine of someone who wanted something for nothing, quietly earning cryptocurrency for a stranger. We do not judge. We record. We let people judge — and then, if they are wise, go to the source and never trust the result.

Follow the Access continues. Case 15 disposition: MINED. Confidence: HIGH — malvertising (impersonating search/display ads) and SEO poisoning (ranking manipulation) are well-documented delivery techniques; the cracked/fake-installer channel and its cryptominer payload are documented, with the spoofed-installer precedent in Kaspersky's DarkHotel; and the honeypot's own most-common capture (RedTail/elf.xmrig) is exactly the bundled miner this channel delivers, corroborating the MINED disposition through a different door. The vector is distinguished from the infostealer (Case 09, an alternative payload) and the watering hole (Case 14, poisoning an already-visited site). The MINED-vs-HARVESTED/RANSOMED note reflects that the same channel can deliver stealers or loaders, but its signature high-volume outcome is the bundled miner. The defense follows CISA malvertising guidance and standard software-acquisition practice. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the poisoned result, and the search that trusted it.