Godot Game Used As Malware

Gaming engines like Godot can be leveraged as a malware delivery vector by embedding malicious code in pack files, which execute upon game loading—demonstrating how legitimate software can be repurposed for cyberattacks 0:52.

Key Takeaways:
• Godot’s GDScript can execute malicious code when pack files load, enabling malware delivery via game assets 1:45.
• A proof-of-concept shows how an HTTP request can download and execute a payload (e.g., Havoc C2) after game startup 3:00.
• The malware can be disguised as a non-functional game with a crash trigger, mimicking a legitimate software failure 14:20.
• Pack files can be encrypted or embedded in executables, allowing stealthy distribution across games or systems 17:21.

This demonstrates that while Godot is a legitimate tool, its capabilities can be exploited for malicious intent—emphasizing the importance of code integrity and user awareness 18:37.

Sources:

• 0:52 Overview of Godot being used as a loader in malware campaigns.
• 1:45 Explanation of GDScript execution during game load.
• 3:00 Demonstration of HTTP request to download and execute a payload.
• 14:20 Crash trigger used to simulate malware behavior.
• 17:21 Discussion of encrypted pack files for stealth.
• 18:37 Clarification that Godot has no vulnerability; misuse is intentional.