Police warn of malicious 'Cheat Lab' program targeting gamers

A gaming PC keyboard is seen in this stock image. (RDNE Stock project/Pexels)

Police in Kingston, Ont. have issued a warning to residents regarding a malware attack that is targeting video gamers.

Fraudsters are posting links in comment sections of video game websites and forums, offering a program called "Cheat Lab" that claims to offer ways to help players cheat at various games. The program, however, allows cybercriminals to access your computer and your personal data.

• Sign up now for daily CTV News Ottawa newsletters
• The information you need to know, sent directly to you: Download the CTV News App

"At first glance, Cheat Lab appears to be a legitimate program and even has an activation code. If you install it, there is a message with an offer to receive a free version of the software if you send it to your friends. However, the program is actually malware," Kingston police said in a news release.

According to the New Jersey Cybersecurity and Communications Integration Cell (NJCCIC), Cheat Lab appears to be a variant of a different Trojan Horse-style malware called Redline.

"Redline is an information-stealing malware capable of acting as a backdoor, carrying out tasks from the command-and-control (C2) server, and exfiltrating data," the government agency said.

Kingston police are advising gamers to be skeptical of offers and deals.

"If you find a link for a free product that seems too good to be true, it probably is," police said.

"When downloading software, be mindful of the source. Legitimate companies do not distribute their software by posting links in comments. You should only download software from a trusted company or source."

The NJCCIC, however, notes that the Cheat Lab malware was found on Microsoft's GitHub, which is widely used for legitimate purposes by millions of people daily.

"The file was not part of the repository itself but was uploaded as a comment on an issue of the project. Threat actors exploited a flaw in which GitHub automatically uploads files attached to comments to GitHub’s content delivery network (CDN). The URLs generated for these files include the repository’s name, which gives the appearance of being associated with the project," the NJCCIC said.

It also recommends exercising caution with links found in comments, even if they may appear to originate from legitimate sources.

While this particular scam targets gamers, police warn that similar tactics could be used against anyone.

"Always stop and think before clicking on a link."