Hackers abuse popular Godot game engine to infect thousands of PCs

Check Point Research uncovered a GodLoader malware campaign that abuses the Godot game engine and GDScript to embed and execute malicious code inside .pck game package files, evading many antivirus detections and enabling credential theft and additional payload delivery (including XMRig). The attackers used the Stargazers Ghost Network DaaS and hundreds of GitHub ghost repositories to distribute infected tools and games across multiple waves (Sept–Oct 2024), with researchers estimating over 17,000 infected systems and showing the technique can be adapted to Windows, macOS, Linux, Android, and iOS.