Battlefield 6 malware campaign: hundreds of players potentially compromised

The launch of Battlefield 6 in October 2025 triggered a wave of cyberattacks targeting players. Bitdefender Labs has uncovered a sophisticated malware campaign exploiting the popularity of EA’s game through fake cracks and trainers distributed on torrent sites. Who is behind these attacks? What techniques do the cybercriminals use? How can players protect themselves?

Battlefield 6, developed by DICE and published by Electronic Arts, sold more than 7 million copies in three days after its release on 10 October 2025. Such a major commercial success inevitably draws the attention of malicious groups, who exploit the impatience of players looking to get the game for free or to gain a competitive edge through trainers.

Anatomy of the Battlefield 6 malware campaign

Bitdefender researchers identified three distinct infection vectors in this Battlefield 6 malware campaign, each with different technical characteristics, as described on their blog.

The infostealer disguised as a trainer

The first sample poses as a Battlefield 6 trainer installer. Despite its small size and lack of obfuscation, this malware quickly extracts sensitive data as soon as it runs. It targets local user directories and browser profiles to steal crypto wallets and cookie sessions from Chrome, Edge, Firefox, Opera, Brave, Vivaldi and WaveBrowser. Discord session tokens and data from crypto wallet extensions such as iWallet and Yoroi are also among its targets.

Exfiltration goes to the IP address 198.251.84.9 over plain HTTP, with no attempt to hide the traffic. Paradoxically, the malware’s simplicity is its strength: it works even inside virtual machines and evades some antivirus solutions based on complex behavioural analysis.

The site flingtrainer.io, which hosts this malware, offers many other “trainers” performing the same kind of data theft. The FLiNG name is in fact borrowed from a legitimate developer known for game modification tools.

The evasive InsaneRamZes malware

The second sample, distributed as “Battlefield 6.GOG-InsaneRamZes”, implements advanced evasion techniques. Before deploying its payload, the malware builds an array of regional identifiers and stops running if it detects Russian or CIS country settings (Russia, Armenia, Azerbaijan, Belarus, Kazakhstan, Kyrgyzstan, Lithuania, Uzbekistan).

This geographic self-protection is frequently used by Russian malicious groups to avoid legal exposure in certain jurisdictions. Disassembling the code reveals a locale comparison against specific codes, leading to immediate termination on matching systems.

The malware also uses Windows API hashing to obscure how it works. At runtime, it computes the hash of each target API from system DLLs. When a match is found, the API is stored for later use. This technique makes static analysis of the binary considerably harder.

A timing check using GetTickCount() lets the malware detect sandbox environments by measuring system uptime. Analysis of in-memory strings reveals references to software such as CockroachDB, Postman, BitBucket and FastAPI, suggesting it targets API keys and database credentials.

Although the sample crashed before fully executing its payload, the evidence points to an intent to harvest credentials beyond the usual browser and Discord data.

The RUNE C2 agent

The third sample, disguised as a Battlefield 6 ISO image, deploys a persistent command-and-control agent. The ISO contains a 25 MB MZ executable that includes a ZLIB-compressed object. When run, the binary decompresses the ZLIB content, writes a file named 2GreenYellow.dat to the user directory and silently executes it with the regsvr32.exe /s /i command, where the /i flag triggers the DLL’s DllInstall export function.

The DLL includes three standard exports (DllRegisterServer, DllInstall, DllUnRegisterServer). Once initialised, it repeatedly tries to contact ei-in-f101.1e100.net, a Google-owned domain potentially used as a relay or to disguise C2 communications.

Although the C2 communications failed during testing, the code structure indicates it was designed for remote command execution or data exfiltration. A C2 agent opens almost unlimited attack paths, from persistence to lateral movement to deploying additional payloads.

Abusing the names of legitimate groups

The attackers behind this Battlefield 6 malware campaign cleverly exploit the reputation of legitimate cracking groups. InsaneRamZes and RUNE are real names in the warez scene that regularly crack new titles. This impersonation lends apparent credibility to the malicious files and increases the likelihood of infection.

The RUNE group has in fact released a genuine Battlefield 6 crack, which will only add to the confusion and encourage accidental downloads of infected versions. Users of well-known torrent trackers risk downloading the malicious version by mistake, as it is hard to tell apart from legitimate releases.

The game piracy ecosystem

Battlefield 6 includes advanced protection and a massive multiplayer component, which usually delays cracking. Games with these characteristics generally take several weeks, or even months, before a working pirated version appears. None of the samples analysed by Bitdefender offer any Battlefield-related functionality, confirming that they are purely disguised malware.

Game trainers are applications that let players change certain parameters, such as increasing in-game resources or becoming invincible in FPS games. These tools mainly work on single-player titles, and using them in multiplayer usually leads to a ban. Security solutions sometimes flag legitimate trainers as potentially dangerous because their behaviour resembles some malware.

Scale of the Battlefield 6 malware campaign

Bitdefender observed hundreds of active seeders and leechers on the malicious torrents, indicating a potentially high number of victims. The Battlefield 6 trainer appeared on page 2 of a simple Google search, maximising its exposure to players looking for a competitive edge.

Game piracy statistics show that around 10% of players have downloaded or played a pirated game in the past three months. An AVG study indicates that more than 90% of cracked games downloaded via torrents or file-sharing sites contain malware or malicious code. Between 2018 and 2020, a similar campaign compromised 3.2 million Windows PCs and stole 1.2 terabytes of personal information, including 26 million login credentials.

Protection recommendations

Several protective measures are essential in the face of this Battlefield 6 malware campaign. Buying and downloading games exclusively through official platforms (EA App, Steam, Epic Games Store, Uplay, GOG) eliminates the risk of infection from pirated versions. Avoiding torrents, third-party trainer utilities and unknown executables is a key barrier.

Real-time behavioural protection blocks malicious payloads before they execute. Modern solutions detect suspicious behaviour such as data exfiltration attempts or unauthorised C2 communications, even for previously unknown malware.

Vigilance remains essential when searching for cracks or trainers. Results on Google’s first page do not guarantee that a site is legitimate. Recently registered domains hosting trainers for recent AAA games should always be treated as suspicious.

Battlefield 6 malware campaign FAQ