Hackers Exploit Godot Game Engine to Infect 17,000 PCs with GodLoader Malware

Hackers have leveraged the popular Godot game engine to spread GodLoader malware, infecting over 17,000 systems within three months. By exploiting Godot’s scripting language and packaging capabilities, cybercriminals bypass detection and deliver payloads like the XMRig crypto miner. This attack highlights the need for vigilance within open-source communities and enhanced protection against malware disguised as legitimate tools.

Malware Targeting Gaming Platforms:

  • GodLoader malware uses the Godot engine’s scripting language, GDScript, to execute malicious commands across Windows, macOS, Linux, Android, and iOS platforms.

Exploitation of Open-Source Tools:

  • Attackers package malware scripts in Godot’s .pck files, evading traditional detection systems and leveraging trust in open-source repositories.

Mass Infections in a Short Timeframe:

  • Over 17,000 systems were compromised between June and October 2024, with attackers stealing credentials and delivering XMRig crypto miner payloads.

Dark Web Malware-as-a-Service (MaaS):

  • The campaign was conducted via the Stargazers Ghost Network, a distribution-as-a-service platform that utilizes over 3,000 fake GitHub accounts to deploy malware.

Sophisticated Delivery Mechanism:

  • Malware was spread through 200+ GitHub repositories, leveraging GitHub’s trending algorithms to appear credible and attract unsuspecting developers and gamers.

Cross-Platform Threat Potential:

  • While current samples primarily target Windows systems, proof-of-concept exploits demonstrate adaptability to macOS and Linux, posing a wider threat.

Financial Gains for Threat Actors:

  • The Stargazers Ghost Network has generated over $100,000 in revenue by distributing various malware payloads like RedLine and Lumma Stealer.

The exploitation of the Godot game engine by GodLoader malware underscores the growing sophistication of cyber threats in open-source ecosystems. This attack demonstrates the urgent need for developers and gamers to exercise caution when downloading tools or games from repositories. Strengthening endpoint protection, including advanced malware detection solutions like Net Protector Antivirus, is vital to safeguard against emerging threats in trusted platforms.