The Fake Cheat That Drains Every Account You Own

By Kim Njuki October 17, 2026 Updated: October 17, 2026 4 min read

The most effective malware delivery channel in PC gaming is not a sketchy torrent site. It is the promise of a free cheat.

A cheat has to reach into a game's memory, inject into processes, and usually run as administrator — often while you disable or whitelist your antivirus because the cheat "triggers false positives." That is the exact environment a piece of malware wants, and the attackers know it. ESET's analysis of RedLine Stealer notes that the malware "masqueraded as video game cheats in the first half of 2024" — one of the two most common disguises, alongside fake ChatGPT downloads.

What these stealers take

RedLine, first spotted in 2020 and sold as malware-as-a-service so anyone can run a campaign, harvests saved browser credentials, cookies, autofill and credit-card details, cryptocurrency wallets, and "saved data from Steam, Discord, Telegram, and various desktop VPN applications," per ESET. Vidar Stealer does the same job with a different codebase. Both exfiltrate quietly, often within minutes, and the victim sees nothing.

The sessions are the worst part. A stolen session cookie or Steam token is a logged-in state — two-factor authentication does not stop an attacker who already holds the session.

The campaigns are not subtle

• A BleepingComputer report described a RedLine-linked campaign using fake "Cheat Lab" and "Cheater Pro" tools, distributed as ZIP files with an MSI installer that unpacks a Lua bytecode payload. The kicker: the fake cheat promised a free licence if you convinced your friends to install it too — turning victims into distributors.
• ASEC researchers found fake Valorant "auto-aim" cheats promoted through YouTube video descriptions, delivering RedLine from an archive containing a file literally named "Cheat installer.exe."
• In March 2026, Acronis Threat Research Unit reported hundreds of GitHub repositories offering "free game cheats" that actually deliver Vidar Stealer 2.0, alongside Reddit posts pushing a fake Counter-Strike 2 cheat.
• The problem is not confined to third-party sites. In February 2025, a free-to-play game called PirateFi was pulled from Steam after researchers at SECUINFRA identified it as distributing the Vidar infostealer; TechRepublic reported that as many as 1,500 people had downloaded it before removal.

The last one matters because it breaks the "only download from Steam" advice. Steam review caught it eventually, but not before real players were infected — and the advice that follows from it is not "don't use Steam," it is "treat any free game, cheat, or mod as suspect until you have verified where it came from."

How to tell a fake before you run it

No cheat tool from an unknown source is trustworthy, and none of these are digitally signed by a real entity. The telltale signs:

• It arrived through a Discord DM, a YouTube video description, a Reddit comment, or a search ad — not the game's official site or a mod platform with a review process.
• It asks you to disable your antivirus or Windows security features "to avoid false positives." Legitimate software does not need you to disarm your defences.
• It is delivered as an obscure file type — an MSI with a .lua or bytecode payload, a self-extracting archive with an invalid signature — rather than a straightforward installer from a known publisher.

What to do instead

The defence is boring and it works. Get mods from platforms with actual review and moderation — Nexus Mods or CurseForge — not from a link someone sent you. Keep your antivirus on and updated, and do not add exclusions for anything you cannot verify. If you already ran something you are not sure about, assume the worst: change your passwords from a clean device, revoke active sessions on Steam and Discord, and check your Steam API key page for anything you did not create.

One more thing worth saying plainly: if you installed a "cheat" and it worked, that is not evidence it was safe. Plenty of these loaders ship a functional cheat alongside the stealer, because a working tool is the best way to keep you from uninstalling it.

Sources

• ESET — Analysis of RedLine Stealer infostealer empire
• BleepingComputer — Fake cheat lures gamers into spreading infostealer malware (Apr 2024)
• BleepingComputer — Fake Valorant cheats on YouTube infect you with RedLine stealer (Mar 2022)
• Infosecurity Magazine — Vidar Stealer 2.0 Exploits Fake Game Cheats on GitHub, Reddit (Mar 2026)
• TechRepublic — Steam Malware Alert: PirateFi Game Spreads Vidar Infostealer (Feb 2025)