That Free Cracked Software May Be Renting Out Your PC

We all know someone who has “a guy” who can get any software for free.

Need Microsoft Office? Free.
Need an expensive design package? Free.
Need a game that launched yesterday? Somehow also free.

Normally, the conversation around cracked software focuses on viruses, stolen passwords and dodgy pop-ups. Those are still very real risks, but Microsoft has now uncovered something slightly different—and honestly quite clever.

A recent fake-download campaign is turning ordinary Windows computers into money-making assets for somebody else.

Your PC can continue working normally while criminals quietly use your internet connection, processor and electricity in the background.

In other words, you downloaded free software and accidentally became someone else’s unpaid hosting provider.

How the fake software download works

According to Microsoft Threat Intelligence, the campaign targets people searching for cracked commercial software, free games, activators, plugins and unofficial utilities.

The download looks like a normal Windows installer. It may even use the familiar installation wizard people have seen hundreds of times before.

You click Next, accept the terms you definitely did not read, wait for the progress bar and then carry on with your day.

Behind the scenes, however, the trojanised installer can quietly retrieve and install several additional components. Microsoft identified three main ways the attackers are monetising affected computers:

• Routing third-party internet traffic through the victim’s connection
• Enrolling the PC in distributed-computing services
• Installing unwanted utility or advertising software

The scary part is that the computer does not necessarily stop working.

There may be no dramatic ransom note, skull-and-crossbones wallpaper or flashing warning telling you that something is wrong. The PC may simply feel hotter, slower or strangely busy when you are not doing much.

Someone else may be using your internet connection

One of the payloads identified by Microsoft installs software called WorldProxyPool.

This turns the affected computer into part of a proxy network. Internet traffic belonging to other people can then be routed through the victim’s connection.

To the outside world, that traffic may appear to come from your public IP address.

That creates more than just a performance problem.

If somebody uses your connection for scraping websites, creating fake accounts, bypassing regional restrictions or other abusive activity, your IP address may be the one that gets flagged or blocked.

South African fibre packages may be uncapped, but that does not mean you want complete strangers using your line as part of their private network.

Your processor can also be put to work

Microsoft also found installers deploying distributed-computing software, including BOINC-related components.

Distributed computing itself is not automatically malicious. It is commonly used for legitimate scientific and research projects.

The problem is consent.

If software is installed quietly and begins using your CPU, GPU, memory and electricity without your informed permission, then somebody else is benefiting from resources you paid for.

Possible warning signs include:

• Fans running hard while the PC is idle
• Unexplained heat
• Poor battery life
• Sluggish performance
• High processor or graphics-card activity
• Unexpected bandwidth usage
• Strange applications or scheduled tasks
• Software returning after you thought you removed it

None of those symptoms proves that this specific campaign is present. A dusty cooling system, failed drive, Windows update or badly behaved legitimate application can cause similar problems.

That is why diagnosis matters.

“But my antivirus says the file is clean”

This is where people get caught.

Attackers constantly change files, domains and delivery methods. A newly created installer may not be detected immediately by every antivirus platform.

Some campaigns also bundle software that sits in an uncomfortable grey area. The individual component may have a legitimate purpose, but the method used to install it—and the lack of proper consent—is the real problem.

A quick scan is useful, but it is not always enough to prove that a PC is clean.

A proper investigation may need to check:

• Installed applications
• Startup entries
• Scheduled tasks
• Browser extensions
• Temporary installation folders
• Windows services
• Network activity
• Defender history
• User accounts and administrator permissions

If the machine was used for banking, business email or Microsoft 365, you may also need to review account access and change passwords from a known-clean device.

Free software is rarely completely free

I understand why people use cracked software. Proper licences can be expensive, especially for students, freelancers and small South African businesses trying to keep costs under control.

But if a commercial program normally costs thousands of rand and an anonymous website is offering it for nothing, there is usually another business model hiding somewhere.

Sometimes you pay with adverts.

Sometimes you pay with your personal information.

And sometimes you pay with your bandwidth, processing power, electricity and the reputation of your internet connection.

What should you do if you installed cracked software?

Do not panic and immediately start deleting random Windows files.

Disconnect the computer from sensitive business systems if you have a genuine reason to suspect compromise. Make a note of what was installed, where it came from and when the symptoms started.

Then have the device properly assessed.

The right answer may be removing an unwanted program. It may also require a deeper clean-up, password resets or a complete Windows rebuild if the machine can no longer be trusted.

That “free” installer may have saved you a few hundred rand.

It may also be quietly earning money for someone else every time you switch on your PC.