Cheat and Crack Lures on GitHub

Hundreds of GitHub repositories promise game cheats, cracks and "trainers" but hold no file. Their README links to a hub repository's release or to an outside download site. The hubs serve oversized archives built like known stealer loaders.

Result of the second pass (30 October 2026, 13:26 UTC). All 80,929 candidate repositories were read at a pinned commit, with their releases and archive hashes. 12 repositories on 11 accounts are proven to lead to malware and are included in the headline total. 1,422 more link to the hubs and sites described below and stay suspected. A full read of the ~59,000 repositories without any lure signal is still running; it can only add suspects, not change the proven count. The per-hub tables further down are first-pass observations from 29 October.

What counts as proof here. A repository is proven only if its own release, or a release its README links to, carries an archive that MalwareBazaar names with a malware family, or that at least 5 VirusTotal engines detect and whose majority category is a malware type (trojan, stealer, downloader and similar). HackTool, RiskWare and PUA labels do not count: antivirus gives them to genuine cheats. These rules were fixed before the VirusTotal results were read.

What was rejected and why. A first automated classification reported 1,437 "confirmed" repositories. I did not keep that number:

• 1,432 of them only linked to hubs and sites that this page itself calls suspected. A link proves the link, not the malware.
• Of the 6 MalwareBazaar matches, only one names a family (NWHStealer). One unnamed match is the installer of a widely used open-source game-mod loader, so an unnamed MalwareBazaar entry is not proof.
• After the VirusTotal phase, a manual review removed 11 more rows. Seven linked a well-known open-source privilege-escalation audit tool, which antivirus flags as a trojan. Four linked an activation tool and a game cheat whose detection label describes the tool itself.

The 12 proven repositories:

The six "BITCOIN-WALLET-CRACKER" repositories sit on six accounts whose names follow one pattern: a first name, often followed by a surname or a word, then random letters and digits. One of these accounts also holds the aimbot lure.

The two largest hubs, Loader.v2.6.zip and Setup.zip, were still not known to VirusTotal on 30 October. Hub 2's archive was replaced on 29 October at 14:17 UTC, and neither its old nor its new hash is known. They remain strongly suspected, not confirmed. A clean or missing VirusTotal result does not clear an archive, because padding defeats many scanners.

• Four hubs serve an archive with the same name, Loader.v2.6.zip. Two of them had disappeared by 29 October 2026. A new hub appeared on 28 October, and the same day 129 lures were updated to point to it.
• The two live hub archives are 82 MB and 117 MB. Their main executable is mostly compressible filler, next to "DLLs" of a few hundred bytes or system-named libraries.
• Neither archive was known to VirusTotal on 29 October. This is strongly suspected, not confirmed malware. I did not run anything or visit the outside sites.

The proven set was closed on 1 November 2026 with what had been found up to 31 October 2026, 17:59 UTC; repositories found after that are tracked separately and are not in these figures. The full proof pass at pinned commits ran on 30–31 October. On 1 November 2026, 18:23 UTC a read-only GitHub API recheck covered the 162 repositories, 73 accounts and 12 issues that are tracked one by one (operator repositories, Shai-Hulud accounts, phishing issues), not the whole set.

• Frozen: 12 README lures under 11 accounts are counted; 1,422 further lures remain suspected only.
• State: both hub repositories were still public on 1 November; the second hub's archive was replaced on 29 October.

These are first-pass counts from 905 template repositories, not totals.

Two description templates dominate: " Hack Trainer for Windows 10/11. Undetected cheat…" (108 repositories, 54 owners) and an unfilled "{title} is a feature-rich third-party modification project…" (132 repositories).

• Bursts: nine accounts made 238 lures for Hub 1; 46 accounts made one lure each for one outside site.
• Rotation: two hub owners were gone by 29 October. All 129 lures for Hub 2 were last pushed on 28 October, the day Hub 2's archive was uploaded, although some were created on 5 October. That looks like a batch re-pointing; it is an inference from timestamps.
• Replaced asset: lures from late September already linked Hub 1's v2.6 download, but the current file was uploaded on 26 October. Earlier downloaders may have received a different file.
• Real downloads: Hub 1's counter rose from 281 to 285 in about an hour on 29 October.

An executable declared larger than the archive holding it is mostly compressible filler. That is consistent with binary padding, a way to exceed the size scanners and VirusTotal accept [6]. System-named DLLs beside an executable are consistent with DLL side-loading. Hub 1's combination of WinGUP's gup.xml, a large libcurl.dll and filler DLLs resembles the padded archives Arctic Wolf described for the BoryptGrab stealer in July 2026 [4, 5]. That is a layout match only; their published page lists none of these hashes or domains.

One of eleven versions of Hub 4's launcher is detected by 18 VirusTotal engines (generic trojan label). No candidate lure links that hub's releases directly, so Hub 4's lures stay suspected.

1. A cheat or crack README whose only content is a link to another account's release is a lure. Hunting by the hub link finds hundreds of lures at once.
2. Report hubs and lures together. Lures are re-pointed within a day when a hub disappears.
3. Treat archives with a 100 MB+ executable that compresses heavily, or DLLs of a few hundred bytes, as hostile, whatever antivirus says.
4. "Free" cheats and cracks are a standard stealer delivery route [1, 2, 3]. Do not run them on a machine that holds passwords, wallets or work credentials.

• No archive was run or extracted; only the first 20 file entries were read.
• Outside sites were never visited.
• The first README pass covered 905 template repositories; the full second pass is still running.
• Domain registration and reputation data come from earlier notes and were not re-checked.

This article is part of the GitHub threat investigation. Counts are a snapshot, not evidence that the code ran on a victim's machine. The shared methodology and proof rules explain inclusion, exclusions and the independent re-check.