The Reddit Scenario That Should Scare Every IT Admin
An IT admin posted a question that's more common than it should be: an outside vendor had been installing pirated proprietary software on a client's laptop — and then asked the admin to help enable it. The admin's instinct was right to pause. But many business owners and IT staff don't pause. They assume the vendor knows what they're doing, let them work, and move on.
That assumption can cost you far more than a licensing fine.
You're Not Just Risking a Fine — You're Risking Your Network
Let's be direct: when a vendor installs unauthorized or pirated software on your business machines, you inherit every risk that software carries. You don't get to point at the vendor when the auditor or the attacker shows up.
Here's what's actually at stake:
Legal liability. Software license compliance isn't optional. If audited by the BSA (Business Software Alliance) or a software publisher, it's your company on the hook — not the vendor who installed it. Fines can run into tens of thousands of dollars per unlicensed copy, and "my vendor did it" is not a legal defense.
Malware delivery. Pirated software is one of the most reliable malware delivery mechanisms in existence. Cracked installers are routinely bundled with infostealers, ransomware droppers, and remote access trojans. According to SANS ISC, malicious MSI installer files — the exact format many Windows software packages use — are actively being weaponized to deliver malware through what looks like a legitimate installation process. A vendor running an unvetted MSI on your machine is indistinguishable from that attack vector.
Supply chain backdoors. You don't have to be running pirated software to face this risk — but pirated software makes it dramatically worse. According to The Hacker News, attackers recently hijacked over 400 Arch Linux AUR packages and rewrote build scripts to deploy credential stealers and eBPF rootkits. The business owners and developers who ran those packages had no idea what was actually being installed. That's the same blind trust you extend when you let a vendor run software you haven't reviewed.
Hidden backdoors. Even well-known, established software can be tampered with. According to The Hacker News, attackers recently tampered with JavaScript files from trusted WordPress plugins — including PushEngage, OptinMonster, and TrustPulse — to plant hidden admin backdoors on thousands of sites. The site owners trusted the software. That trust was exploited. When a vendor installs something on your machine, you're trusting their entire software supply chain.
The Specific Scenario: What To Do Right Now
If you've discovered a vendor installed pirated or unauthorized software on your business machines, here's a practical response:
1. Isolate the Affected Machine
Take the machine off the network immediately. Don't wait. If it's already been running the software for days or weeks, assume the worst and act accordingly. This limits lateral movement if something malicious is already present.
2. Do Not Enable or Activate the Software
If you were asked to help activate or enable the pirated software — as the Reddit admin was — refuse. Activating it doesn't just complete the installation; it may trigger additional payloads, phone-home behavior, or license validation routines that connect to attacker-controlled infrastructure.
3. Document Everything
Screenshot the software, note the vendor, record dates and who had access. This documentation protects you legally if the situation escalates — whether that's a software audit, a breach investigation, or a vendor dispute.
4. Run a Full Malware Scan — Then Go Deeper
A standard antivirus scan is a starting point, not a finish line. Rootkits and infostealers installed alongside pirated software are specifically designed to evade endpoint detection. You need to check for persistence mechanisms, scheduled tasks, new user accounts, and outbound connections to unusual destinations.
5. Audit What Else That Vendor Touched
This is the question most businesses skip. If the vendor installed unauthorized software on one machine, what did they do on the others? Review their access logs, check every system they touched, and verify nothing else was changed.
6. Reassess the Vendor Relationship
A vendor who installs pirated software — whether out of laziness, cost-cutting, or malicious intent — is a vendor who doesn't respect your security posture. As we covered in our guide to securing IT infrastructure during acquisitions, third-party access is one of the most overlooked attack surfaces in small business environments. Vet vendors before they touch your systems, not after.
CMMC and Compliance Implications
If you're a government contractor working toward CMMC Level 1 compliance, this scenario carries additional weight. Unauthorized software on controlled systems can disqualify you from contracts and trigger reporting obligations. Our CMMC Level 1 compliance guide covers the baseline controls you're expected to maintain — and "unknown software installed by a third party" is not a state that passes any audit.
The Broader Pattern: Third-Party Trust Is a Security Problem
This vendor scenario is one instance of a much larger problem. Businesses routinely extend implicit trust to outside parties — vendors, contractors, MSPs, plugins, packages — without any mechanism to verify what those parties are actually doing on their systems. We've written about this pattern in the context of supply chain attacks and OAuth token theft, and the thread is consistent: the attacker doesn't need to break in if you've already handed the keys to someone who doesn't protect them.
Pirated software is just the most visible version of this problem. The vendor who installs a cracked copy of software to save a client $200 may have just handed an attacker a persistent foothold worth far more.
What You Should Have in Place Before This Happens
- A vendor access policy that requires approval before any third party installs software on your systems
- Application allowlisting or monitoring so you know when new software appears on endpoints
- Regular vulnerability and configuration scans to catch unauthorized changes before they become incidents
- Clear contracts with vendors that specify liability for unauthorized software installations
The goal isn't to assume every vendor is malicious. It's to have visibility into what's on your systems so that when something sketchy does show up, you catch it fast.
Take Action
You can't protect what you can't see. If a vendor — or anyone else — has had unsupervised access to your systems, the right move is to verify the current state of those machines before assuming everything is fine.
Oscar Six Security's Radar gives you an affordable, actionable vulnerability scan for $99 — so you know exactly what's running on your systems, what's exposed, and what needs attention. Proactive scanning catches the problems that slip in through trusted third parties before attackers find them first.
Focus Forward. We've Got Your Six.