👾 We're in the Malware Simpocalypse!
... and we were hit with more .TS4SCRIPT malware in November 2024.
Here's what I've read...
There have been several reports of hacked profiles by multiple Sims 4 content creators. The hackers have recently updated the content files, which can compromise your files and computers if downloaded.
If you downloaded anything in the last 24 hours remove it and run scans!
...and...
Mods from TwistedMexi and Moxiemason were updated recently after being inactive for a long time. The creators have confirmed they did not upload these and their accounts were hacked. The compromised mods have been altered to include a new script called “mod.pyc” that is definitely malware.
If you have downloaded anything from MTS in the last 24 hours run a virus scan now. Do not run the game while the compromised mods are on your PC. Do not download ANYTHING from MTS. It’s likely there’s been a data breach/mass attack and a lot more mods are compromised.
I SAID IT COULD HAPPEN AGAIN AND IT HAPPENED AGAIN. THEY HIT US WITH MORE TS4SCRIPT MALWARE AND THIS TIME THEY COMPILED THE PYTHON SCRIPT SO IT CAN'T BE READ EASILY!
In case no one else here was present back then, the second-party (if I called them third-party before, I apologize) hosting websites said (not all of them, but we can pretend) they put new measures in place and I wondered, "What measures could you put in place to detect compromised PYTHON script?". I'm not a security expert so I genuinely don't know. Well... it's November now and those with their crosshairs on our community realized they should've compiled the !@#$ing script the first time around.
Here's the statement from ModTheSims. This is at least better than what everyone did last time.
https://modthesims.info/showthread.php?t=687747
What has happened was that a malicious actor logged into 2 creators accounts that have been inactive for a long time, and "updated" the files to contain a specific .ts4script which, when run by the game, created a profapi.dll file, which is a trojan. (See [💀 SNIPPED]). This affected only 4 files that we can see, all of which are now removed from the server. (We removed the files approximately 1.5 hours after they where updated)
This issue affected ONLY these 4 mods and ONLY specifically .ts4script files.This ONLY affected 4 specific files ONLY for The Sims 4. IT DID NOT AFFECT ANY OTHER DOWNLOADS
If you downloaded these mods AFTER 19:53, 5th Nov 2024 (UTC), and BEFORE the date of this post, then please remove the files:
No Mosiac / Censor Mod by moxiemason - I suppose since this is proper ded, I might as well share mine. I dissected WickedWhims, I know how to do some !@#$.
AllCheats - Get your cheats back! by TwistedMexi
CAS FullEditMode Always On by TwistedMexi
Full House Mod - Increase your Household Size! by TwistedMexi
All of these are popular mods. I don't use any of them but they are popular mods.
NO OTHER FILES HAVE BEEN AFFECTED. IT IS SAFE TO DOWNLOAD OTHER FILES, FROM OTHER GAMES, AND FROM MTS IN GENERAL
Going forward, I'm going to implement more robust security around inactive accounts, or accounts that have not been logged into for a long time, so that if the passwords are leaked elsewhere, they cannot be used without additional verification.
Edit: Okay so I've implemented the following changes:
- All new logins on an account will now send an email titled "New Login Detected" to the email address on that account. (Similar to how Netflix, etc, do that).
- Accounts that have been inactive for more than 3 months and have a new login on them are now automatically locked and cannot be used for some tasks until an email link is confirmed.
Locked accounts can not:
- Reply to threads or downloads.
- Post new threads or downloads
- Edit existing downloads or posts
- Upload files
- View Private Messages
- Change any profile information, including password or email address.
Hopefully this should provide an extra level of security, but minimise the amount of mail spam for otherwise legitimate purposes.
Regarding attack vectors - this issue ONLY affected .ts4scripts (so, The Sims 4), and thus, I'm going to add some automated checking for, and decompiling of, any python files, to check for any odd behaviour.
Regards
I have a question. I have multiple questions.
If MTS wasn't compromised this time, who is compromised?
How do they have TwistedMexi and moxiemason's passwords?
Why wasn't "DECOMPILING ANY PYTHON FILES" done since the last time and has anyone else bothered to implement this or did we really, genuinely take the "This was just some amateur with a grudge! Tis business as usual, folks!" approach? I- I know it's what everyone was saying but... is that really the mentality we embraced?
When this happened in February, I was so busy maintaining the Reddit post and responding to comments and direct messages that I didn't post about it here. I meant to because I wanted to throw a lot of shade at everyone involved including the creator community and this is one of the places I can speak freely within reason. I didn't. By the time the dust had settled I was knee-deep in modding and just figured I'd leave it alone, but here were are again and the mentality that was displayed was clearly embraced, or at least some part of it was.
HOW DO THEY HAVE TWISTEDMEXI AND MOXIEMASON'S PASSWORDS? WERE THEY COMPROMISED AT SOME POINT OR WERE MTS' RECORDS COMPROMISED AT SOME POINT?
⚡ I want to clarify this. TwistedMexi released a statement saying avoid MTS and how MTS hasn't been a valid place to download their mods for like 5 years now, but the mods are still there, innit? While there is a note on their creator page about not maintaining their MTS account, there are no notes in their mod descriptions, or if there are, I didn't read long enough to see them. How many simmers do you suppose take the time to check profiles and read every bit of information everyone puts out everywhere including the multiple Discord groups? I know this !@#$ is time consuming but cover your bases. As creators we have a responsibility to the community who we DIRECTLY AND FINANCIALLY BENEFIT FROM. MTS says they weren't compromised THIS TIME and that someone used the passwords to access the accounts. This can mean multiple things - MTS was compromised at some point and all of our accounts are compromised or the creators were compromised at some point and because "they don't maintain their MTS accounts anymore", their passwords haven't been updated in a very long time, even after February happened. This is the shade. ☔ I respect all of these people and their talents, but don't bullshit me with half-arsed accusations tossed around willy nilly. We went down this same road back in February and March with other popular creators. You won't see it now but there was a lot of shade thrown at everyone in my Reddit post before Reddit wonked out and ate 4/5 of it, and I do mean everyone, including AHQ, the second-party hosting websites, the creator community and the simming community (for saying stupid !@#$ like "[X] is well-known and popular so there's no reason to worry" as though MSQSIMS isn't a well-known and popular creator).
I can't get my !@#$ approved on MTS despite having a 16 year-old account, but hackers can gain access to popular creator profiles and push compromised updates. Yeah, that's some shade right there, innit - at me! 😹
Have you noticed I have a bit of an ego? I'm not wrong though, am I? I might not have all the information or know what's in everyone's minds but I think my assessment is valid.
I had the most "fun" back in February with Deaderpool pushing a minor update for MC Command Center during the Malware incident and only notifying Discord, like why do you have a website and Patreon, bruh? S4MP never even got back to me about their "repackaging" explanation, you can't tell me you repackaged your old version when your internal modified dates don't match, bruh! In case you're wondering, yes, simmers approached me with concerns and I investigated to the best of my ability and was usually met with "irritability" by the creator community and their assistants. It's like no one understood why simmers were concerned and instead blamed it on people like me for sharing the information... "You can totes trust me, I'm never compromised! Kekeke!" No, no one actually said those exact words. 😹
WE ARE IN THE MALWARE SIMPOCALYPSE. BE AWARE OF THE DANGER AND BE CAREFUL WHERE YOU DOWNLOAD YOUR MODS FROM. THE MALWARE WE SAW IN FEBRUARY CAN RUIN YOUR LIFE. I'M NOT EXAGGERATING. IT'S NOT AMATEUR MALWARE, IT'S BLACK-MARKET DARK WEB SHIT SIMILAR TO WHAT THEY USE TO BLACKMAIL CORPORATIONS AND GOVERNMENTS.
Malicious users do not care how few people are infected before they're shut down. Sure, they want everything, but compromising even one person can potentially net them access to everyone that person knows and everyone those people know. It's not just about you. It never is.