How are hackers using Inno Setup Installer to deliver malware in 2026?

Cybercriminals are increasingly misusing the Inno Setup Windows installer framework to slip malicious code past unsuspecting users and security tools. By embedding multi‑stage payloads inside seemingly harmless installers, attackers are quietly delivering RedLine Stealer, HijackLoader, and other info‑stealing malware while evading signature‑based defenses.

Why Legitimate Installers Are Becoming a Go‑To Attack Vector

• Users naturally trust well‑known installation wizards.

• Security products often grant installers elevated privileges to finish setup tasks.

• Popular frameworks such as Inno Setup and NSIS support powerful scripting engines that can be hijacked for covert behavior.

What Makes Inno Setup Attractive to Threat Actors

Inno Setup is an open‑source tool designed to simplify software deployment. Key features that attackers abuse include:

• Pascal scripting that can download, unpack, or run additional payloads.

• Customizable GUI elements that disguise malware as genuine apps.

• Built‑in compression that hides large binaries in a single executable.

By leveraging these capabilities, adversaries produce installers that look and feel legitimate while executing malicious logic in the background.

Inside the Latest Malware Campaign Uncovered by Splunk

Stage One – Weaponized Installer

The installer’s Pascal script uses XOR‑encrypted strings to hide command‑line arguments and URLs until run time. It then extracts embedded resources and launches a decoy program so the user sees a normal setup window.

Stage Two – Environment Reconnaissance

A burst of Windows Management Instrumentation (WMI) queries checks running processes and hardware profiles. If sandbox tools or virtual‑machine artifacts appear, the installer immediately exits to avoid analysis.

Stage Three – Persistence & Payload Deployment

The script drops an encrypted DLL to %APPDATA%\Roaming\controlExplore\ and registers a hidden scheduled task that runs at reboot. A legitimate binary (ScoreFeedbackTool.exe) later side‑loads the trojanized QtGuid4.dll, which decrypts HijackLoader and finally launches RedLine Stealer inside MSBuild.exe to blend with trusted Windows processes.

Infection Chain at a Glance

Advanced Evasion Tactics Observed

• Filename pattern checks (e.g., application_stable_release) to decide when to run.

• Multiple layers of XOR encryption around configuration data.

• Abuse of trusted Windows utilities to blend malicious activity with normal OS behavior.

• Early termination if debugging or monitoring tools are present.

Understanding RedLine Stealer – The Endgame

Once running, RedLine Stealer harvests browser passwords, session cookies, and cryptocurrency wallet files before exfiltrating them to a command‑and‑control server. Because the stealer rides inside MSBuild.exe, many endpoint products treat the process as benign, giving attackers an extended window to siphon data.

Indicators of Compromise (IOCs)

• Unexpected scheduled tasks referencing WhatsAppSyncTaskMachineCore.

• Executions of MSBuild.exe from user‑profile paths.

• Outbound traffic to rare or newly registered domains over ports 443 and 18852.

• Presence of ScoreFeedbackTool.exe alongside a modified QtGuid4.dll.

How to Defend Against Inno Setup Abuse

• Block unsigned or unknown installers via application‑allow‑listing tools.

• Enforce digital‑signature validation for all internal software packages.

• Deploy behavior‑based detections that flag installers spawning scripting engines, WMI queries, or MSBuild.exe children.

• Inspect scheduled‑task creation in user contexts; flag invisible or oddly named tasks.

• Train users to verify download sources and checksum values before launching any installer.

Key Takeaways

• Attackers are capitalizing on the implicit trust users place in installers like Inno Setup.

• Multi‑layer evasion—encryption, sandbox checks, DLL side‑loading—keeps detection rates low.

• Security teams should treat installer abuse as a rising threat class and update controls accordingly.

• Proactive monitoring of scheduled tasks, MSBuild.exe spawn patterns, and unusual outbound domains is critical to spotting infections early.