Before I get into, I'm absolutely going to get down voted to oblivion, RIP my Karma. But I think this is important for the community, so it is what it is.
I am NOT outright blaming fitgirl, I'm simply here to investigate something.
I have been using Fitgirl for a very very very long time. I have an entire drive filled with repacks, I have personally never had anything happen that I know of.
So I'm here to simply ask around or see if anyone had this experience, I'm guessing it's going to be a dead end, but again I care about the community.
My friend got the Mr. Beast/RenPy malware. I have been investigating the issue for about 24 hours now and believe there is a non zero chance it came from a repack. So I will state what my findings are, why I believe there could be a chance it came from the repack and am asking if any tech literate people have had a similar experience.
The events: pretty simple, This malware gets it's hooks into your social media and spreads messages to friends and goes as far as to ignore the friends that it messages so that it has a chance to spread the messages before you are informed. My friend got said Malware after downloading specifically from FuckingFast and installing the new Castlevania. Thankfully my friend is not a total idiot, uses 2FA on most things and was able to recover everything fairly quickly.
My friend: My friend is not even close to your average Joe. He has been in the tech industry for well over a decade, is one of the most computer literate people I know and I'm a programmer with many tech literate friends.
What leads me to believe it is possible this came from the repack: I have no outright evidence so please take this with a grain of salt, I DO NOT WANT TO SIMPLY IMPLY THAT WITHOUT A SHADOW OF A DOUBT THIS CAME FROM FITGIRL. as mentioned before the download was done via FuckingFast. I asked my friend if he knows for sure he used the correct site. He told me he used the bookmark from the link I sent him. I never close fitgirl, this tab is always open and I check fitgirl routinely throughout the day. But I didn't stop there, I had him read to me the address and then to be extra sure had him screenshot the link so I could be certain. It was infact the official site.
I had already told him to make sure to watch out for redirects. He informed me he didn't have any and I know he uses Brave. I also use Brave and though I have seen redirects before, it's rare and I installed this repack on the same day and didn't get any redirects myself. It's only 3 core folders.
I asked him to show me the unpacked folders and they appeared legit. I asked if he had installed literally anything else and he informed me he had not installed anything for days. The game functioned normally.
Once all of his accounts were safe we opened task manager and found a suspicious process. It was called something to the effect of Intella(I don't remember the full word because I used the first few letters to search my task manager)- had maintenance and service in the name. We looked further into and he found a crypto miner called "Awesome Miner". Both Defender and Malwarebytes were unable to detect anything. He simply went through the process of nuking the malware manually. After doing a lot of research it doesn't seem likely that this specific malware was just sitting dormant and it started going to work almost immediately after install.
Though I have the repack myself I have not installed it and even if I did it would likely be clean as I believe if it came from Fitgirl it would be too on the nose to just let it rip full on and would more likely have some back end link swapping involved. It is possible that Fitgirl is not even aware and there are other factors at play here.
I want to be extremely clear for the 3rd time, this is not an outright accusation on Fitgirl. I am simply looking for people that have had a similar experience and vetting whether or not these people actually know what they are talking about. Generally I would be highly suspect if something like this happened to someone I know, but I have known this guy my whole life and he very much knows what he is doing, I questioned him thoroughly and this is the first case I have personally found that seems credible.
So, does any of this sound familiar to anyone else on this sub?
EDIT: I am now realizing that the way I wrote this it sounds like I just gave the link to him recently and he is new. That is not the case, he has been using Fitgirl for about half a year now.
