More Malicious Mods – Warning For All CC Users

There are more malicious mods being uploaded to the Sims community—please be safe out there!

Previously we’ve shared information regarding two separate attempts being made by a nefarious individual at getting CC users to download their malicious files. They’ve done this by posing as the creator(s) of established mods for The Sims 4, but recently have stepped up the bad behavior even more.

In one of their previous attacks, the individual stole a mod by MSQSIMS and reuploaded it to CurseForge with malware files attached, albeit under a different username. Earlier today however it was revealed that MSQSIMS’ account on The Sims Resource has been hacked and at least 2 of her other mods, Weather and Forecast Cheat Menu and Seasons Cheats Menu, have been affected.

According to a post by LittleMsSam on Tumblr the .exe file only affects Windows users, so Mac and Linux players are currently safe. The file appears to steal passwords from Operating Systems, Internet Browsers, Discord, Steam, and Telegram, along with unspecified crypto wallets.

Are You Affected By A Malicious Mod?

Because of how quickly new attack attempts have been popping up across various mod platforms, at this point it’s hard to say with complete certainty that any place is 100% reliable for mod safety. If you’ve downloaded any Custom Content in the past 2 weeks, you might as well do a check for the malware.

According to LittleMsSam’s post, the following actions will allow you to check for dangerous files related to this situation:

1. Open the “Run” command on your computer by pressing your Windows key + R or by searching “run” in the Start Menu
2. Paste or type the command %AppData%/Microsoft/Internet Explorer/UserData and hit Enter
3. Check the folder that opens for a file called “Updater.exe”

If you see the “Updater.exe” file in this folder, you have unfortunately been infected with this malicious mod malware.

Removing The Malware

After the incident on CurseForge new safeguards were put in place to prevent such a thing from happening again. Additionally, Overwolf (owner of CurseForge) has created a program to scan for & remove this malware, which should work even if you didn’t get the malware from CF in the first place. Head over to GitHub and download “SimsVirusCleaner.exe” which will quickly check your system and remove the bad files.

Keep Up To Date With The Situation On Discord

If you’d like more information on this malicious mod event or want to keep up with any future developments, head to the Sims After Dark server on Discord. This is an ongoing situation so please be safe out there and don’t download any mods from users or locations you don’t know or trust.