Grand Theft Auto V has quickly become one of the most-popular games on Steam since its launch just a couple of months ago. Many players like to expand the available content in the game by using third-party mods, a common activity in nearly all major games today across all genres.
For GTA V, two of the most popular so far have been Angry Planes and No Clip. Angry Planes allowed the player to spawn several aggressive aircraft with pilots that hated you while No Clip allowed the camera to go anywhere.
They have been downloaded by thousands of people, linked to on community forums across the Internet and even featured on dedicated gaming news sites with massive audiences including PC Gamer and Kokatu, prompting hasty apologies from those sites who had included them.
Digital Trends reports how the malware came to light on the GTAForums when a user noted some suspicious activity on their computer. The cause was a program called “fade.exe”, which was sending data over the Internet through another program that it had hijacked.
Scanning the program revealed it to be a malicious keylogger that was collating every keypress and sending it to servers online. The biggest surprise was yet to come though when a Malwarebytes scan revealed that the process had been started by the Angry Planes mod.
Other users quickly confirmed the mod as the source of the malware as launching GTA V with Angry Planes enabled quickly started “Fade.exe”. The same thing happened with No Clip.
The attack is unusual and very original. It is very rare for game mods to be dangerous and as such people who downloaded these lighthearted additions would have done so expecting it to do exactly what it said.
Unfortunately, Angry Planes and No Clip opted to silently install malware behind the scenes. GTA mod sites are now recommending that users only upload mod source code files for approval rather than potentially hazardous executable files so that all mods can be verified as safe before being offered for download.
If you play Grand Theft Auto V and use either of these mods then you should remove the offender immediately. There is a detailed set of instructions on GTAForums and users are advised to change their passwords. If you notice “Fade.exe” running on your computer after launching GTA V then you should close the process immediately and check your mod list.
