Popular GTA V mods come with unwanted malware

Two popular Grand Theft Auto V modifications have been found to contain unwanted additional malware, according to The Escapist.

Modifications allow fans of games to change the way they play in fundamental ways, and are often done with the blessing of the publishers. The two mods in question are Angry Planes and Simple Noclip. The former spawns aggressive planes which attack the player, while the latter allows players to walk through walls and objects. Although both delivered the promised features, they came up with a nasty surprise exposed on GTAForums.

It seems the downloads come with a keylogger, which sends its data to a remote server. The Escapist also notes that it contains modules for ‘flooding targets with network traffic.”

Although not everyone has reported being able to find evidence of the malware – which seems to come packaged as a file called fade.exe – gamers who have run the mods are warned to take no chances, and to change all their passwords to be on the safe side. It is not unheard of for malware to remove its files to avoid detection, after all. That said, The Independent claims that users who haven’t run the mods may be safe, as “just downloading it is thought not to cause the problems.”

The site has since removed the two mods, and promised a more thorough approvals process in future in order to flush out malicious modifications before they can do their damage. “If you post compiled scripts in .asi, .dll, or .net.dll formats, the approval process will be much lengthier. We recommend avoiding these formats completely and publishing your mods as .lua or .cs source files, these kinds of scripts will be approved very quickly because the source can be verified,” the site owners wrote.

360b / Shutterstock.com
by Alan Martin, ESET

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s