1. Introduction

Pirated software is the entry vector that almost no company monitors, and that is precisely why it works so well. While security teams watch phishing, exposed RDP and vendor vulnerabilities, an employee installs the latest “cracked” version of a professional tool and unwittingly hands over the keys to the domain. The BSA study based on more than 22,000 responses across 110 economies estimated that 37% of software installed worldwide is unlicensed; in Western Europe the figure was 28%.

The chapter on pirated software use in the author’s book “Protocolos y procedimientos prácticos de ciberseguridad” (Confemetal, 2026) documents the full chain: the cost of related malware was estimated at around $359 billion and, according to the estimates it cites, 1 in 3 pirated downloads contains malware. In this article we explain how it gets in, which malware families ride along, why it affects the company even when the device is personal, and how to prevent it and respond to it.

The goal: make pirated software in your business stop being an IT taboo and become a managed risk, with policy, controls and legitimate alternatives.

2. The Crack as a Vector: You Install Unverified Code

A crack, a keygen, a patch, a P2P download or a “recompiled” installer from Telegram or Discord are, technically, the same thing: unverified binary code with no reliable origin, executed with the user’s privileges. The key insight of the chapter is psychological: cybercriminals keep these sites alive because users disable their antivirus to run the crack. There is no conscious complicity, but there is a voluntary switch-off of the last defense layer at the worst possible moment.

Moreover, most pirated downloads happen during working hours, from corporate or personal devices connected to the company network, with corporate credentials open on the same machine. The download is not an incident: it is the first step of a chain designed to end in ransomware or credential theft.

3. The Malware Families That Ride Inside the Crack

The chapter lists the families repeatedly packaged into pirated software. The table summarizes their profile:

Family	Type	What it does
RedLine	Infostealer	Theft of credentials, cookies and wallets
Lumma	Infostealer	Very active in 2024-2025, focused on session theft
Vidar	Infostealer	Exfiltrates data to a C2 managed over Telegram
StealC	Infostealer	Since 2023, distributed via YouTube and torrents
AsyncRAT / Remcos	RAT	Remote control: camera, microphone, keylogger
XMRig	Miner	Monero mining on design and gaming machines
Cobalt Strike Beacon	Post-exploitation	Professional tool used in manual operations

Fig. 1 – Malware families commonly found in pirated software, according to chapter 3 of “Protocolos y procedimientos prácticos de ciberseguridad”.

The difference between an infostealer and a RAT changes the response: a keylogger or a RAT means the attacker could be watching the screen in real time; a miner such as XMRig is often the spearhead of an intruder already evaluating the network. Do not rule out the Bitcoin clipper, which swaps wallet addresses on the clipboard.

4. The Corporate Risk Chain: From Crack to Ransomware

The chapter reconstructs the chain with precision. Step one: the employee installs the crack on a personal or corporate device. Step two: the infostealer steals credentials (M365, Git, cloud, VPN) and session cookies — and cookies bypass MFA, because the session is already authenticated. Step three: silent persistence for days or weeks. Step four: the credentials are sold to an initial access broker, who auctions them to ransomware groups.

The result is the classic breach that “makes no sense”: the company had EDR, awareness training and MFA, but the entry point was a crack carrying an infostealer. There is also a legal dimension that many companies ignore: even if the carelessness is the employee’s, responsibility under the GDPR remains objective for the organization; the stolen data belonged to the company and its customers.

5. The Typical Profile: The Technical Staff Member with Expensive Software

The chapter highlights a clear pattern: pirated software concentrates on expensive tools used by technical profiles with access to intellectual property. AutoCAD, SolidWorks, Adobe Creative Cloud, Microsoft Office, IDEs, VMware or video editing tools are the natural candidates. The paradigmatic case: the engineering department with a cracked AutoCAD on a machine with access to product drawings, or the designer with pirated Photoshop on the same machine that opens email.

That coincidence — expensive software, technical staff and access to sensitive information — turns the risk critical: the malware installs exactly where the data the attacker wants lives. The lesson is that this problem is not one of “licenses in order”, but a data classification problem: it exposes the most valuable asset at the exact point an attacker wants to reach.

6. The Legal Dimension: Criminal Code Article 270 and BSA Audits

Beyond the technical risk, there is a direct legal risk. Software intellectual property is protected in Spain by the Intellectual Property Law (RDL 1/1996), and unauthorized distribution or use can fall under article 270 of the Criminal Code, which punishes piracy of protected works. BSA audits, Adobe compliance programs or Microsoft license verifications are regular procedures that can surface unlicensed software, with regularization costs and reputational damage.

In a regulated environment (NIS2, ISO 27001, ENS), unlicensed software also becomes an aggravating factor in audits: without a license there are no guaranteed patches, and without patches the vulnerability is known and has no accountable owner. The book summarizes it this way: such software not only exposes you to malware, it also prevents you from demonstrating minimum control to an auditor or regulator.

7. Prevention: Four Fronts That Work

The first front is a formal, signed policy: an authorized software list, a request procedure with a reasonable SLA (so nobody turns to a crack out of urgency), an explicit ban on cracks and patches with examples, a BYOD regime and clear employment consequences. A policy without a fast request procedure is doomed to fail: people pirate out of operational need, not desire.

The second front is technical, and here the chapter is conclusive: the highest-impact measure is revoking local administrator rights. Without admin rights, most cracks cannot install and the infostealer loses its ability to steal in depth. It is followed by execution allow-listing (WDAC or AppLocker on Windows, SELinux or AppArmor on Linux), one-click PUA/PUP blocking in the EDR (Defender, CrowdStrike, SentinelOne, Sophos, Trend), proxy web filtering (Cisco Umbrella, Cloudflare Gateway, Zscaler, Netskope) and periodic software inventory inspection with SAM tools (SCCM, Intune, Lansweeper, ManageEngine, Snow, Flexera). An example of how to start that inspection on Windows:

# Quick inventory of installed software (start of a SAM review)
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Select-Object DisplayName, Publisher, InstallDate | Sort-Object DisplayName

# Installation events for new executables and services
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} -MaxEvents 100 |
  Where-Object {$_.Message -match 'rundll32|msiexec|powershell'}

Fig. 2 – Inventory and installation audit commands to detect unauthorized software, inspired by chapter 3 of the book.

The third front is legitimate alternatives, which remove the operational excuse: LibreOffice or OnlyOffice instead of office suites; Affinity, GIMP or Pixelmator instead of Adobe; DaVinci or Kdenlive instead of video suites; Fusion, FreeCAD or Blender in CAD; VS Code, JetBrains or Eclipse in development; VirtualBox, Proxmox or Hyper-V in virtualization; and 7-Zip or PeaZip for compression. Before assuming “there is no alternative”, the chapter recommends a formal evaluation exercise: many times the cost of migrating is lower than the risk being eliminated.

The fourth front is dedicated, non-tangential awareness: a specific session on downloads and cracks, separate from the phishing campaign, with a safe reporting channel without retaliation. The chapter states it plainly: the silence of a scared employee costs more than the incident they report on time.

8. If It Is Already Installed: The Response

When pirated software is confirmed on the fleet, the first step is inventory and triage: how many machines, which software — it is not the same to find a cracked WinRAR as a crack that downloads Cobalt Strike — and whether there are compromise indicators in the EDR, SIEM or outbound connections, in which case it is treated as a breach rather than a simple license violation. Windows events 4688 and 7045 help answer who executed what and when.

If there are malware indicators: forensic acquisition with chain of custody (ISO/IEC 27037, RFC 3227), generating IOCs from the sample for a lateral search across the whole fleet, and remediation with a clear principle from the book: in critical environments you do not negotiate, you reinstall from a clean image. If an infostealer was involved, rotate all credentials and revoke all cookies and sessions, and review cloud services (forwarding rules, OAuth, recent downloads). Then comes legalization: license the software, negotiate with the vendor and set up a SAM program if it does not exist yet. The incident closes with a policy review as a case study, without identifying anyone, and with periodic audits integrated into the ISO 27001 or ENS cycle. To go deeper into the privacy side of this phenomenon, you can read our article on how to approach censored applications, and to integrate software control into your security plan, our guide on planning and designing technical audits.

9. Conclusion

Pirated software is not a licensing problem: it is an entry vector with compelling statistics — 37% of unlicensed software worldwide, 1 in 3 pirated downloads carrying malware and $359 billion in associated cost. The book’s defense is pragmatic and cheap: a signed policy with a fast request procedure, revoking local admin as the highest-impact measure, execution allow-listing, EDR with PUA blocking, SAM inventory, legitimate alternatives and dedicated awareness. Every machine with pirated software is a door you did not know was open; the goal for 2026 is to know what is installed on every machine and why.

Need help with Pirated software business risk?

At Jaymon Security, we help organizations protect their systems. From security audits to SIEM/SOC implementation, our expert team designs custom solutions.

Contact us for a free infrastructure assessment.