It&#x27;s usually hidden in the EULA. Very hidden.<p>It&#x27;s not just Filezilla or sourceforge doing this. Lenovo do this routinely. They used to bundle something called BrowserGuard, which contains a PUP by Conduit. Conduit have since been partially acquired by another company Perion. I followed that rabbit hole last year, Lenovo point blank refuse to acknowledge it is spyware.<p>And it IS spyware. I created a Perion account to see what they actually had going on. They have an online form you can upload your executable to and it wraps their malware in the form of a toolbar. I tested it by uploading notepad.exe, and sure enough it works quite easily.<p>They capture your location and a whole bunch of data about your computer. They also have remote update facilities built into it. It&#x27;s pernicious, and the company structure has been designed to make it very hard to determine who owns it. And Lenovo were very happy to use them.<p>Oh, and here is an article that confirms the autoupdate:<p><a href="https:&#x2F;&#x2F;support.lenovo.com&#x2F;au&#x2F;en&#x2F;documents&#x2F;ht101178" rel="nofollow">https:&#x2F;&#x2F;support.lenovo.com&#x2F;au&#x2F;en&#x2F;documents&#x2F;ht101178</a>