A new information-stealing malware, believed to be linked to Redline, is emerging in the gaming world. Named “Cheat Lab,” this fake game cheat software is spreading by promising a free copy to gamers who convince their friends to install it.
The gaming world faces hreat from fake cheat software
Redline is a powerful information-stealing malware that collects sensitive information from computers, such as passwords, cookies, autofill details, and cryptocurrency wallet information. This attack demonstrates that downloading software from trusted sources like Microsoft’s GitHub could lead to Redline virus infections.
Users are advised to avoid unsigned executable files and files downloaded from untrusted websites. The following are the methods of spreading and how this malware operates:
Stealthy Spread: According to McAfee threat researchers, this new information-stealing malware uses Lua bytecode to make detection difficult. It injects into legitimate processes for stealth and takes advantage of Just-In-Time (JIT) compilation performance.
Distribution Methods: This malware, also known as Cheat Lab and Cheater Pro, spreads through URLs linked to Microsoft’s ‘vcpkg’ GitHub repository that mimic demo versions of cheat tools. The malware is distributed as an MSI installer containing two files. When the installer is executed, it reveals the malicious Lua bytecode hidden in the ‘readme.txt’ file.
Call to Spread Among Friends: This campaign uses an advanced distribution method, offering victims a fully licensed copy of the cheat software for free if they invite their friends to join.
This new threat compels gamers and internet users to be more aware and cautious when downloading software. The potential dangers of cheat software from unreliable sources pose significant risks, especially regarding the protection of personal information.
This scenario underscores the importance of strengthening cybersecurity measures for everyone. To avoid these new threats, what precautions do you take? Share your suggestions and experiences in the comments section below.
{{user}} {{datetime}}
{{text}}