How Hackers Use Inno Setup Installers to Deliver HijackLoader and RedLine Stealer

Key takeaways

• Inno Setup is legitimate; the abuse is in what attackers put inside an installer.
• The reported chain: weaponised installer, WMI environment checks, hidden scheduled task, DLL side-loading, then RedLine inside MSBuild.exe.
• Detect behaviour: MSBuild with odd parents or network traffic, new scheduled tasks, signed programs loading unsigned DLLs.
• Cracked software and fake downloads are the usual delivery route; rotate passwords and sessions from a clean device after an infection.

What is Inno Setup, and is it a problem?

Inno Setup is a free, legitimate tool that developers use to build Windows installers. It has a scripting language based on Pascal, can compress files into a single executable, and lets authors run code during installation. Thousands of genuine programs install this way, so an Inno Setup installer is not suspicious in itself. The same flexibility is what attackers abuse: they build an installer that looks like normal software, but its script quietly drops and runs malware.

How do attackers use Inno Setup installers?

An installer is trusted by users and often runs with the rights needed to write files and create scheduled tasks. Attackers wrap malware in one for several reasons:

• It looks familiar. The user sees a normal wizard, often with a fake application name.
• The script can hide intent. Pascal script can decode strings at run time, so URLs and commands do not appear in plain text.
• It packs everything into one file, including a decoy program, so the user sees something working while other code runs.
• It can check the environment and stop if it looks like a sandbox or analysis machine.

Such installers usually reach victims through fake downloads, cracked or pirated software, search-result poisoning and malicious ads, rather than through anything exotic. Our article on Oyster malware and fake PuTTY installers shows the same delivery pattern.

A reported campaign, stage by stage

Splunk's threat researchers analysed a campaign that used an Inno Setup installer to deliver HijackLoader and then RedLine Stealer. The details below are as reported in that analysis; check Splunk's own write-up for the original and for any updates, since we have not reproduced the sample ourselves.

Techniques are listed in MITRE ATT&CK, where you can read how each one is detected.

What is RedLine Stealer?

RedLine is an information stealer sold and used on cybercrime markets. It collects saved browser passwords, autofill data, session cookies, cryptocurrency wallets and some system information, and sends them to the attacker. Stolen session cookies are especially dangerous because they can let an attacker access an account without the password and sometimes without a second factor. Law enforcement action against RedLine infrastructure was reported in late 2024, but stealers of this kind continue to circulate under other names and builds, so defensive habits matter more than the family name.

Indicators reported for this campaign

Use these as starting points for hunting, not as a complete list. Attackers change names and domains between campaigns.

• A scheduled task named like WhatsAppSyncTaskMachineCore that you do not expect.
• MSBuild.exe running from, or launched by, a program in a user profile path, or making outbound connections.
• A signed legitimate executable sitting next to an unexpected, modified DLL, for example the pair of file names above.
• Outbound traffic to rare or newly registered domains on port 443 and on port 18852.
• A folder such as controlExplore under the user's Roaming AppData folder.

How can defenders detect it?

Focus on behaviour, because file names and hashes change.

1. Process creation. With Sysmon event ID 1 or EDR telemetry, alert on MSBuild.exe whose parent is not Visual Studio, a build agent or a developer tool, and on installers that launch scripting engines or MSBuild.
2. Network from MSBuild. Sysmon event ID 3 or firewall logs showing MSBuild.exe connecting to the internet is unusual on most machines.
3. Scheduled tasks. Enable auditing for task creation (Windows event ID 4698) and review tasks created in user context, with hidden settings or odd names.
4. Image loads. Sysmon event ID 7 can show a signed program loading an unsigned DLL from a user-writable folder, which is a side-loading signal.
5. WMI bursts. A short run of WMI queries for processes and hardware from an installer process is a known reconnaissance pattern.
6. Egress. Alert on new or rare domains and unusual ports, and use DNS filtering.

How to reduce the risk

For organisations

• Use application control (Windows Defender Application Control or AppLocker) so only approved installers and binaries run, and block execution from user-writable folders where practical.
• Restrict MSBuild.exe and similar developer tools to machines that need them.
• Turn on attack surface reduction rules and keep endpoint protection updated.
• Require signed internal software packages and verify signatures.
• Remove local admin rights for ordinary users.
• Protect accounts with phishing-resistant multi-factor authentication, and shorten session lifetimes for sensitive apps so stolen cookies expire quickly.

For individuals and students

• Download software only from the vendor's official site or a trusted store. Avoid cracked software and "free" activators, a leading route for stealers.
• Check the digital signature: right-click the file, choose Properties, then Digital Signatures. Unsigned installers from unknown sources deserve caution.
• Compare the file's checksum with the one the vendor publishes, if they publish one.
• Do not ignore SmartScreen and antivirus warnings.
• Do not store important passwords only in the browser, and use a password manager with MFA.

What if you think you ran one?

1. Disconnect the device from the network.
2. From a different, clean device, change passwords for email, banking, social and work accounts, and revoke active sessions.
3. Move any cryptocurrency from wallets on the infected machine to a new wallet created on a clean device.
4. Run a full scan with up-to-date endpoint protection, and consider reinstalling Windows, since persistence mechanisms can survive cleaning.
5. If money was stolen, call 1930 and report at cybercrime.gov.in. Organisations should report incidents to CERT-In.

Career angle

This campaign touches core blue-team skills: reading process trees, writing detections from ATT&CK techniques, and tracing persistence. Learning Windows internals, Sysmon and a SIEM is a direct route into SOC work.

Next steps

To practise detection with real telemetry, see WebAsha's SOC analyst course. Related reading: what fileless malware is and how to detect it and malicious Calendly and Google Meet links.