HackTool:MSIL/FakeHack.PL is a deceptive program marketed as a hacking or cheating tool for games and software but actually functions as a trojan delivery mechanism. Written in Microsoft Intermediate Language (MSIL/.NET), this threat typically masquerades as game trainers, credential generators, or software activation cracks while secretly installing backdoors, information stealers, or cryptocurrency miners on the infected system. Users who download and run these fake hacking tools thinking they're getting free game cheats or software licenses end up compromising their machines instead.
The "FakeHack" classification indicates this malware exploits users' willingness to download dubious tools that promise unauthorized advantages. While the initial executable may appear to deliver some superficial functionality to maintain the illusion, the real payload operates silently in the background—stealing credentials, downloading additional malware, or enrolling the computer in a botnet. Because these programs are intentionally downloaded and run by the user (albeit under false pretenses), they bypass many of the behavioral filters that would normally stop drive-by infections.
Threat Profile
| Attribute | Details |
|---|---|
| Threat Type | Trojan, HackTool, Fake Application |
| Family | FakeHack (MSIL variants) |
| Platform | Windows (requires .NET Framework) |
| Aliases | MSIL/FakeHack, Trojan.FakeHack, HackTool.FakeHack, Gen:Variant.Zusy (generic detection) |
| Discovered | Active variants observed since 2016; PL variant circa 2018–2019 |
| Distribution | File-sharing sites, crack/keygen repositories, YouTube video descriptions, torrent trackers, gaming forums |
| Persistence | Registry Run keys, scheduled tasks, startup folder shortcuts, service installations (varies by payload) |
| Primary Capabilities | Backdoor installation, credential theft, cryptocurrency mining, clickfraud modules, secondary payload delivery |
| Typical Artifacts | Random-named .exe in %TEMP% or %APPDATA%, .NET assembly DLLs, modified browser shortcuts, registry keys under HKCU\Software\ |
| Network Behavior | Command-and-control beaconing (often HTTP/HTTPS), downloads encrypted payloads, exfiltrates system information and credentials |
| Data at Risk | Browser passwords, gaming credentials, cryptocurrency wallets, email accounts, FTP credentials stored in FileZilla/similar |
| Removal Difficulty | Moderate—malware itself is straightforward, but secondary payloads may include rootkit components or fileless malware requiring deeper remediation |
How It Spreads
HackTool:MSIL/FakeHack.PL spreads exclusively through social engineering—the user deliberately downloads and executes it believing they're installing a useful tool. The threat actors behind this malware exploit the demand for free cheats, cracks, and hacking utilities by bundling trojans with non-functional or barely-functional tools. A YouTube video promising "unlimited V-Bucks" or "free Steam games" will include a download link in the description. A forum post offering a working keygen for expensive software will lead to an executable wrapped with FakeHack. A torrent labeled "Game_Trainer_2023.exe" contains the malware instead of the promised functionality.
The delivery mechanism relies on several psychological factors: users seeking something for free are more willing to ignore security warnings; the promise of gaining an unfair advantage overrides caution; and the social proof of comments (often fake) or view counts creates false legitimacy. Once downloaded, the file typically arrives with an icon mimicking legitimate software and a filename suggesting authenticity. When the user disables their antivirus (as the "instructions" inevitably suggest) and runs the executable, the infection begins.
Common distribution vectors include:
- YouTube tutorial videos with links to file-sharing services (MediaFire, Mega, Dropbox) in the description
- Torrent sites hosting fake cracks, keygens, and game trainers with high seed counts (artificially inflated)
- Gaming forums and Discord servers where users share "working" cheat tools
- File-sharing platforms with names like "Fortnite_AimBot_2024.exe" or "Adobe_Keygen_Universal.exe"
- Warez and crack repository sites that bundle malware with every download
- Search engine results for terms like "[game name] free hack" or "[software] crack download"
- Social media posts promising cheats or free premium accounts
What It Does On Your Machine
Once executed, HackTool:MSIL/FakeHack.PL typically presents a convincing interface—perhaps a fake login screen, a progress bar showing "activation," or a window with sliders and buttons that appear to modify game values. This facade keeps the user distracted while the malware performs its actual functions in the background. Being written in MSIL means the malware requires the .NET Framework (present on most Windows systems) and can be easily reverse-engineered, but that same characteristic allows it to be quickly recompiled into new variants that evade signature-based detection.
The primary payload usually begins by gathering system information: Windows version, installed antivirus products, running processes, hardware specifications, and network configuration. This reconnaissance data gets transmitted to a command-and-control server, which then determines what additional malware to deploy based on the system's value. A gaming PC with cryptocurrency wallet software might receive a dedicated clipper trojan that intercepts crypto transactions. A system with stored FTP credentials might get an information stealer that harvests those and sells them on underground forums. A computer with significant processing power might be enrolled in a cryptocurrency mining botnet.
Credential theft is a near-universal behavior across FakeHack variants. The malware will scan browser profile directories for stored passwords, search the registry for application credentials, look for saved session tokens in messaging applications, and check for cryptocurrency wallet files. Gaming accounts (Steam, Epic Games, Riot, Blizzard) are particularly valuable targets since they can be sold for real money. All extracted data gets compressed, encrypted, and exfiltrated to remote servers—often disguised as legitimate HTTPS traffic to avoid triggering network monitoring tools.
Persistence mechanisms vary but typically include creating a scheduled task that re-executes the malware every time the user logs in, adding a Run key to the Windows registry, or installing the payload as a service with a generic name like "Windows Update Assistant" or "System Configuration Helper." Some variants modify browser shortcuts to inject command-line parameters that load malicious extensions or redirect the home page. The malware frequently attempts to disable Windows Defender and add exclusions for its own directories to prevent detection.
Manual Removal — Step by Step
Disconnect from the Internet
Immediately unplug your Ethernet cable or disable Wi-Fi to prevent the malware from receiving commands, downloading additional payloads, or exfiltrating more data. This also stops any cryptocurrency mining activity that's consuming your system resources. Work offline for the entire removal process.
Boot Into Safe Mode with Networking
Restart your computer and press F8 (or Shift+F8 on newer systems) during boot to access Advanced Boot Options. Select "Safe Mode with Networking." This loads only essential drivers and prevents most malware from auto-starting, making it easier to identify and remove malicious processes. On Windows 10/11, you can also hold Shift while clicking Restart, then navigate to Troubleshoot > Advanced Options > Startup Settings > Restart, then press 5 for Safe Mode with Networking.
Open Task Manager and End Suspicious Processes
Press Ctrl+Shift+Esc to open Task Manager. Look for unfamiliar processes with high CPU usage, especially those with generic names like "svchost.exe" running from unusual locations (legitimate svchost.exe always runs from C:\Windows\System32). Right-click the suspicious process, select "Open File Location" to note where it's stored, then choose "End Task." Don't worry if you're not certain—Safe Mode prevents critical system processes from being killed accidentally.
Remove Persistence Mechanisms
Press Windows+R, type msconfig, and press Enter. Click the "Startup" tab (or "Open Task Manager" on Windows 10/11) and disable any unfamiliar entries, especially those pointing to folders in AppData\Roaming or Temp directories. Next, press Windows+R again, type taskschd.msc, and examine the Task Scheduler Library for tasks that run executables from suspicious locations. Right-click and delete any that look malicious. Finally, press Windows+R, type regedit, navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, and delete any entries pointing to the malware executable.
Delete the Malware Files
Navigate to the folder you identified in Step 03 (typically in AppData\Roaming or AppData\Local\Temp with a random name). Delete the entire folder. Also check your Downloads folder for the original fake tool you downloaded and delete it. Empty the Recycle Bin immediately afterward. If Windows prevents deletion claiming the file is in use, repeat Step 03 to ensure the process is fully terminated, or use the Safe Mode boot to bypass file locks.
Run Malwarebytes and a Full System Scan
Download Malwarebytes (free version is sufficient) from another clean computer if possible, or reconnect to the internet briefly in Safe Mode. Install and run a full Threat Scan—not just the quick scan. Malwarebytes excels at detecting trojan droppers and their payloads that traditional antivirus might miss. Quarantine and remove everything it finds. This step is critical because FakeHack often downloads secondary malware that manual removal might miss.
Check and Reset Browser Settings
Open each web browser you use and check for unfamiliar extensions under Settings > Extensions (Chrome/Edge) or Add-ons (Firefox). Remove anything suspicious. Check your homepage and default search engine settings—reset them if they've been changed. If browser hijacking persists, use the browser's built-in reset/refresh feature to restore default settings while preserving bookmarks and passwords. In Chrome: Settings > Reset settings > Restore settings to their original defaults.
Change All Important Passwords
Assume every password stored in your browser or typed on this computer while infected has been compromised. Starting from a different, clean device, change passwords for email accounts, banking, PayPal, Steam, Epic Games, social media, and any other important services. Enable two-factor authentication wherever possible. If you have cryptocurrency wallets on this machine, transfer funds to new wallet addresses created on a clean device immediately.
Scan with Windows Defender Offline
Some FakeHack payloads include rootkit components. Before returning to normal operation, run Windows Defender Offline (available in Windows 10/11 under Settings > Update & Security > Windows Security > Virus & threat protection > Scan options > Microsoft Defender Offline scan). This reboots into a clean environment and scans before Windows loads, catching anything that hides in the boot process.
Restart Normally and Monitor
Reboot your computer into normal mode. Reconnect to the internet and monitor system behavior closely for the next few days. Watch for high CPU usage when idle, unexpected network activity, browser redirects, or new unfamiliar programs appearing. Run periodic quick scans with Malwarebytes and keep Windows Defender active. If suspicious behavior returns, the infection may have deeper roots than manual removal can address—that's when you bring it to professionals.
Prevention
- Never download game cheats, cracks, or keygens. These are the primary delivery mechanism for trojans, ransomware, and information stealers. If software requires payment, either pay for it or use legitimate free alternatives—the "free crack" is never worth the risk of identity theft or banking fraud.
- Maintain healthy skepticism toward "too good to be true" offers. YouTube videos promising unlimited in-game currency, forum posts sharing "working" hacks, or websites offering expensive software for free are almost always malware distribution channels. Legitimate developers don't give away their work through shady file-sharing sites.
- Keep Windows Defender enabled and updated. Don't disable your antivirus to run downloaded executables—that instruction itself is a massive red flag. Modern security software will block known malware variants, and the minor inconvenience of false positives is preferable to full system compromise.
- Use a standard user account for daily activities. Create a separate administrator account for software installation and system changes. Malware executed under a standard user account has limited ability to install system-level persistence or modify critical Windows components, containing the damage if infection occurs.
- Enable two-factor authentication on valuable accounts. Even if malware steals your password, 2FA prevents account takeover in most cases. Use authenticator apps (Google Authenticator, Authy) rather than SMS when possible, as SIM-swapping attacks can bypass text-message codes.
- Regularly back up important data to offline storage. Keep a recent backup on an external drive that's only connected during the backup process. If ransomware or destructive malware hits, you can wipe the system and restore from backup rather than paying criminals or losing irreplaceable files.
- Educate family members and employees. Technical controls only go so far when users deliberately download and run malware. Explain why cracks and cheats are dangerous, show examples of infected systems, and establish clear policies about what software is acceptable to install.
- Monitor your accounts for unauthorized access. Enable login notifications for email, banking, and gaming accounts. Review your credit card statements regularly. Check your Steam/Epic/Riot account login history periodically. Early detection of credential theft limits the damage before accounts are sold or funds are drained.
Bring It In
If you've attempted manual removal and still notice suspicious behavior, or if the steps above seem overwhelming, bring your computer to our Roswell shop. HackTool:MSIL/FakeHack.PL rarely travels alone—it typically downloads information stealers, cryptocurrency miners, and sometimes even ransomware as secondary payloads. Our technicians use enterprise-grade forensic tools to identify every component of a malware infection, including fileless threats and registry-only persistence that manual removal misses. We'll document what was stolen (credentials, wallet files, saved passwords) so you know exactly what accounts to secure and monitor.
Most FakeHack removals take 2-4 hours including the deep scan and verification testing. We'll also check your system for the vulnerabilities that made infection possible—outdated software, missing security patches, disabled security features—and correct them to prevent reinfection. Call us at (770) 695-6860 or stop by our Roswell location. We're open Monday through Saturday, and we can often provide same-day service for malware emergencies. Don't let this trojan continue stealing credentials and degrading your system performance—let's get it cleaned properly and restore your peace of mind.