Gamers looking for an edge in their favorite titles just handed attackers a front-row seat to their entire desktop. Researchers have identified a new wave of fake game cheats malware hidden inside 11 NuGet packages, disguised as cheats, bots, and management panels for popular online games. The campaign targets players of Albion Online, GTA5RP, GrandRP, Majestic RP, and Throne and Liberty, and it does far more than unlock in-game advantages.
Once installed, these packages quietly install a remote-access tool that captures live screenshots of the victim’s screen. Attackers can then watch whatever appears on that display, including passwords, crypto wallets, and private messages.
How the Fake Game Cheats Malware Campaign Works
Socket’s research team traced the operation to a structured two-stage attack chain. The first stage arrives as a legitimate-looking .NET command-line tool, distributed through NuGet’s DotnetTool package type. Once a gamer installs it, the tool quietly downloads a second-stage executable named pepesoft.exe.
To avoid detection, the downloader resolves GitHub hosts through DNS-over-HTTPS. This technique bypasses local DNS resolvers and network-level sinkholes that security teams often rely on to block malicious traffic. Ten of the 11 samples also request User Account Control elevation, framing the request as a simple clock resync so victims don’t suspect anything unusual.
All 11 packages share identical hardcoded AWS-style credentials and the same process mutex, which links the entire operation to a single toolchain. The downloader passes these credentials to the second-stage payload as environment variables, so the malware’s cloud storage functions work without exposing secrets inside the executable itself.
From NuGet Package to Full Remote Access
Once pepesoft.exe runs on a compromised machine, it logs into Google Sheets and starts building a detailed profile of the victim. The malware collects hardware fingerprints, system hostnames, GPU and CPU models, IP-based location data, and Windows activation status. It also checks a remote ban list every time it launches, giving the operator a centralized kill switch across every infected machine.
Three of the payloads, built for Albion, Calculator, and Throne, run as direct Python bytecode and include a large automation framework with Telegram bot commands. Anyone who sends the /start command in the attacker’s Telegram chat can trigger an unauthorized screenshot of the victim’s game window, full desktop, or specific running programs. This means the attacker doesn’t even need direct access to the malware’s control panel to spy on a victim in real time.
Eight other payloads use PyArmor protection and add a fallback system that reroutes blocked Google Sheets traffic through a hardcoded proxy. This makes basic network blocking far less effective against the campaign.
What Attackers Can See and Steal
Because the screenshot function captures whatever appears on screen at that moment, the risk extends well beyond gaming accounts. If a password manager, browser session, crypto wallet, or private chat window happens to be open during capture, that data goes straight to the attacker’s Telegram interface.
Some of the direct-bytecode variants take things further. On exit, they modify Windows Installer registry policy and can trigger a destructive cleanup routine that wipes subdirectories inside the application’s working folder, erasing evidence of the infection along the way.
Who’s Behind the Campaign
Several indicators point toward a Russian-speaking operator running this as a commercial cheat service. Researchers found Russian-language console output, Russian build comments, and targeting concentrated on Russian-speaking roleplay gaming communities. A storefront at bots.pepesoft[.]ru advertises “bots without bans,” which lines up closely with the ban-evasion features built into the malware itself. Socket has reported all 11 packages to the NuGet security team for removal.
How Gamers Can Protect Themselves
Cheats, bots, and unofficial game tools remain one of the easiest ways for attackers to reach a large, motivated audience. Anyone tempted to install one should stick to verified sources and avoid downloading packages from unfamiliar publishers, even when they appear on legitimate platforms like NuGet.
A few habits go a long way here. Keep sensitive apps like password managers and crypto wallets closed when running unverified software. Use endpoint protection that flags unusual outbound connections, since this campaign relies heavily on covert communication with GitHub and Google Sheets. A VPN also helps mask IP-based geolocation data, which this malware actively harvests and logs for every victim.
Final Thoughts
This campaign is a clear reminder that the tools promising an unfair advantage often carry a much bigger cost. Fake game cheats malware like this doesn’t just risk an account ban. It hands a stranger live visibility into a victim’s entire digital life, from financial accounts to private conversations. Gamers who stick to official sources and keep basic security hygiene in place stand a far better chance of staying off the next ban list, and off an attacker’s screen entirely.
