Mods! They’re a big part of what makes PC gaming so great. They’re an even bigger part of the Grand Theft Auto franchise’s success on PCs. But malicious no-goodniks out there have seized advantage of the current spotlight on GTA V to slip nasty keylogger malware into some of the mods available for the game—including the otherwise awesome-looking “Angry Planes” mod that made the rounds on the big gaming sites this week.
GTA Forums member aboutseven first noticed Angry Planes misbehaving, Kotaku reports. He became suspicious when he noticed an odd C# compiler program running in his system processes, sending and receiving data across the web. Further digging revealed a Fade.exe executable buried in his PC’s Temporary Files folder, keeping logs of his activity and altering the Windows registry to silently launch at system boot. Gulp.
Aboutseven eradicated Fade.exe from his system, but noticed it sprung back to life whenever he ran GTA V with mods installed. After a bit more trial and error, he pinpointed the Angry Planes mod as the culprit. Another mod dubbed “No Clip” was also found to contain the malware.
Why this matters: Bad guys always find a way to ruin a good thing. But this fiasco drives home an important point: Mods are software designed to run on your system, and you should religiously scan all software you download with anti-virus and anti-malware tools before you run them. Yes, even mods.
If you need some AV recommendations and don’t have a dime to spare on premium suites, PCWorld’s guide to building the ultimate free security suite can point you in the right direction.
The dangers of Angry planes
So what, exactly, does Fade.exe do? Fellow GTA Forums member ckck performed an analysis after also being infected by Angry Planes and claims the Trojan malware used his PC to participate in a DDoS attack against a Twitch game streamer. He also says he found the following modules active inside the malware:
- “Facebook spam/credential stealing module
- Twitch spam/credential stealing module
- Messenger.com spam/credential stealing module
- A Steam spamming module
- A Steam module that evaluates the items in your inventory and their value based on current market value
- A Keylogger module that logs individual button presses in an XML like format, it also includes information about context switches (switching from one app/window to another)
- A UDP flooding module
- There were others I hadn’t deciphered and didn’t see in action.”
Fortunately, GTA5-mods.com—one of the sites that hosted the malware-ridden mods as well as many, many more legit GTA V mods—promptly removed the offenders, issuing a public apology and explanation. If you’ve used Angry Planes or No Clip with GTA V, perform an anti-malware scan with one of the AV programs that detects the malicious file. Since the keylogger malware monitors Steam, Facebook, and Twitch, you’ll want to change your passwords for those services, as well. Heck, changing all your passwords would be the smartest idea.