The latest malware hiding in video game cheat codes

Buyer beware when downloading video game cheats.

Gamers have long used cheat codes to enhance their performance in video games. But buyer beware — hackers have recently been lacing malware in video game cheat codes that could allow attackers to hack victims’ microphones or web cameras, according to Cisco Talos research published Wednesday.

The campaign, which appears to have targeted video game players and PC modders, features malware hidden in seemingly legitimate files that users can download to run game patches, tweaks or modding tools.

The malware hackers have used in this campaign, XtremeRAT, can capture audio or video through victims’ microphones or web cameras, take screenshots, upload and download files or log keystrokes.

The victims involved in this campaign have generally accessed the booby-trapped downloads from YouTube videos about game cheats or social media forums about specific games of interest, Cisco Talos said.

“This goes to show how dangerous it is to install random software from questionable sources,” the researchers wrote in a blog.

Even gamers on alert for nefarious code aren’t safe. The Talos researchers point out that the hackers behind the operation worked to conceal their malicious intent by using a VisualBasic-based cryptor, meant to obfuscate the malware. The attackers also worked to make their campaign impervious to anti-malware tools, the researchers said.

It is not clear who exactly the perpetrators of this latest campaign are — the Talos researchers don’t venture a guess — but hackers have used XtremeRAT in both espionage and cybercrime campaigns alike, according to FireEye research.

Video game cheat codes have proven a prudent target for illicit profits. Chinese police and Tencent worked together earlier this week to bust a video game cheat ring that was making some $76 million in revenue for selling cheats to popular video games such as Call of Duty Mobile or Overwatch, according to the BBC.

Attackers frequently pry into video games to hack players. A hacking team in Asia was recently caught compromising the update mechanism for some video games that run on PCs and Macs in order to run surveillance on gamers in Taiwan, Hong Kong and Sri Lanka, according to ESET research. Last year hackers targeted Valorant players with malware in an attempt to steal their usernames and passwords, according to Sophos research.

Other campaigns that have targeted gamers recently include adware targeted at Minecraft players.

US, UK agencies warn hackers were hiding on Cisco firewalls long after patches were applied

Investigators found the malware, dubbed Firestarter, on a federal agency's network in a campaign dating back to at least September 2025.

North Korean operatives spotted using evasive techniques to steal data and cryptocurrency

Mandiant flags fake AI video generators laced with malware

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure