Cheats, mods and 'free' game downloads that carry malware

Why cheats are such a good disguise

Cheat tools need deep access to work: they read or change game memory and try to avoid anti-cheat systems. So users expect to give them administrator rights and to see security warnings. Malware authors take advantage of that expectation.

A person who believes they are breaking a game's rules is also less likely to report a problem or ask for help. That makes cheat users an attractive target, and young players searching for an edge are often the ones caught.

Using cheats in online games also breaks most game rules and can lead to bans, separate from any malware risk.

It is common for cheat downloads to come with a long explanation of why security software flags them: the tool is 'packed', 'obfuscated' or 'injects into the game' so antivirus 'mistakes it' for malware. Some of that may sound technical and convincing. The practical point is that you cannot tell a false alarm from a real one, and the instruction to switch off your protection serves the person who wrote the file.

The same applies to 'loaders' and 'launchers' that claim to download the real cheat after you run them. These are a common way to deliver changing payloads, so even a file that was clean yesterday may fetch something harmful today.

Modding more safely

Mods are a huge part of PC gaming and many are made with care by real communities. Risk goes down when you:

• use the game's official mod support or workshop where it has one;
• use long-established community mod sites with moderation and a visible history for each file;
• read recent comments and check the author's other uploads;
• avoid mods that come as executable programs when the mod type normally uses data files;
• keep your security software on and your system updated.

No source is completely risk free, but a public, moderated hub is far safer than a link in a video description.

Treat a mod that suddenly needs an installer, a separate launcher or switched-off security software as a different kind of file altogether, and look for another source or skip it.

Cracked games and unlockers

Cracked copies of paid games and tools that claim to unlock paid content are common carriers of malware. They come from anonymous uploaders, are modified by design, and are often shared through sites heavy with misleading adverts.

Legitimate free options exist: free-to-play games on official stores, platform giveaways, demos and subscription catalogues. Our free currency generators page explains why 'free premium content' outside official channels should always be treated with suspicion.

A free trial or a demo from the official store lets you try a paid game without the risk that comes with a cracked copy.

What to expect after an infection

Password-stealing malware works quickly. Within minutes of running it, attackers may try your saved passwords, use stolen browser sessions, and message your friends from your chat account, sometimes sending the same malware on.

Act in this order: isolate the device, secure your email from another device, then secure everything else. The NCSC's recovery steps also include logging other devices out, updating devices and telling your contacts. Our hacked account triage covers the platform-specific recovery routes, and the 'test my game' malware page explains why changing passwords on the infected computer is not enough.

If the computer is shared with other family members, consider that their saved passwords and sessions may also have been copied. Everyone who uses the device should change important passwords from another device, starting with email.

A conversation worth having with young gamers

Banning cheats outright rarely stops curiosity. It can help more to explain the trade-off plainly: a cheat download can cost them their whole account, their friends' accounts and the family computer's security, and the game itself may ban them.

Agree that new downloads on shared computers are checked with an adult first, and that a standard user account (not administrator) is used for everyday play. Our parents' guide has more on setting up devices and accounts.

Warning signs on a PC that something is running

Some malware is quiet, but there can be clues that a downloaded tool did more than it claimed:

• Your security software has been switched off or will not turn back on.
• Friends say you sent them links or files you do not remember sending.
• You receive security emails about sign-ins or password changes you did not make.
• The computer's fans run hard and performance drops even when idle, which can be a sign of hidden cryptocurrency mining.
• New browser extensions, toolbars or start-up programs appear.

None of these on its own proves an infection, and a lack of them does not prove the device is clean. If you ran a suspicious download, follow the steps on this page regardless. Our Steam and Epic Games guides explain how to review sign-in activity on PC game accounts.