A method, performed on a processing device, for detecting an activation exploit, the method comprising: executing, by at least one processor of the processing device, at least one detection module, each of the at least one detection module being specific for detecting a respective known activation exploit or a respective class of activation exploit, the respective known activation exploit or the respective class of activation exploit being for deceiving authentication components, such that a counterfeit copy of software is authenticated as a genuine copy of the software; executing, by the at least one processor of the processing device, at least one response module, each of the at least one response module including response logic for performing a corresponding action in response to detecting the respective known activation exploit or the respective class of activation exploit; and executing, by the at least one processor of the processing device, a scanner, which uses an exploit data file, the at least one detection module, and the at least one response module, the exploit data file including at least one entry regarding at least one known activation exploit or class of activation exploit, each of the at least one entry including information regarding one of the at least one known activation exploit or class of activation exploit, comprising location information of a detection module of the at least one detection module, and location information of a response module of the at least one response module; reading, by the scanner, an entry of the at least one entry from the exploit data file; determining, by the scanner, whether the detection module and the response module are present based on the respective location information included in the entry of the exploit data file; and when the detection module and the response module are determined to be present, the scanner performs: scanning to detect a presence of the one of the at least one known activation exploit or the class of activation exploit by executing the detection module, and performing a corresponding action in response to detecting the presence of the one of the at least one known activation exploit or the class of activation exploit by executing the response module. executing, by at least one processor of the processing device, at least one detection module, each of the at least one detection module being specific for detecting a respective known activation exploit or a respective class of activation exploit, the respective known activation exploit or the respective class of activation exploit being for deceiving authentication components, such that a counterfeit copy of software is authenticated as a genuine copy of the software; executing, by the at least one processor of the processing device, at least one response module, each of the at least one response module including response logic for performing a corresponding action in response to detecting the respective known activation exploit or the respective class of activation exploit; and executing, by the at least one processor of the processing device, a scanner, which uses an exploit data file, the at least one detection module, and the at least one response module, the exploit data file including at least one entry regarding at least one known activation exploit or class of activation exploit, each of the at least one entry including information regarding one of the at least one known activation exploit or class of activation exploit, comprising location information of a detection module of the at least one detection module, and location information of a response module of the at least one response module; reading, by the scanner, an entry of the at least one entry from the exploit data file; determining, by the scanner, whether the detection module and the response module are present based on the respective location information included in the entry of the exploit data file; and when the detection module and the response module are determined to be present, the scanner performs: scanning to detect a presence of the one of the at least one known activation exploit or the class of activation exploit by executing the detection module, and performing a corresponding action in response to detecting the presence of the one of the at least one known activation exploit or the class of activation exploit by executing the response module. scanning to detect a presence of the one of the at least one known activation exploit or the class of activation exploit by executing the detection module, and performing a corresponding action in response to detecting the presence of the one of the at least one known activation exploit or the class of activation exploit by executing the response module.