Pay-per-install is a malware business model in which an operator pays a distributor for each successful installation of a malicious or unwanted program. The installer may be a trojanized setup file, a deceptive download, or a bundled payload hidden behind legitimate-looking content. PPI matters because it turns infection into a measurable supply chain: the attacker can buy reach, scale distribution quickly, and swap payloads without rebuilding the whole delivery system.
In real attacks, PPI often appears through SEO poisoning, fake download pages, cracked software, browser redirects, or content channels that users already trust. Defenders should watch for unusual installer behavior, altered browser settings, rogue extensions, and unexpected network calls after a download. Blocking malicious URLs helps, but PPI campaigns also require user-awareness controls and telemetry that can spot the distribution layer, not just the final malware sample.