Re: Malicious Script Mods and Other Malware

Feb. 12

Updated

• TwistedMexi – ModGuard – v1.3, Patreon (not yet available on Curseforge), ts4script file dated 12 Feb. 2024 – "inconclusive" fixed
  

Feb. 12

Updated

• TwistedMexi – ModGuard – v1.4, Patreon (not yet available on Curseforge), ts4script file dated 12 Feb. 2024 – for fewer false positives
  

Feb. 28

Updated

• TwistedMexi – ModGuard – v1.5, Patreon (not yet available on Curseforge), ts4script file dated 28 Feb. 2024 – for better patch compatibility
  

Apr. 7: NEW THREAT

NEW: Malware via a mod that is downloaded as only a text file that contains a link.

Known cases:

• "S4 CAS Tools" on Nexus from user fubruss (the real mod is on Mod the Sims, from the late CmarNYC, dated 18 March 2023)
• “Loading Screen Randomizer” on Nexus from user fubruss (the real mod is on Mod the Sims, from Tesuto , dated 9 January 2024)

Do NOT follow the links in the text files. Do NOT download other files or follow links from this user. No legitimate mod download will EVER consist of only a text file (a file ending in .txt).

If you downloaded either of these, delete them NOW and run a virus scan. NOTE: This malware does NOT require that you run the game for it to install itself, and is not what ModGuard is designed to detect and stop.

July 24: Updated the main post to reflect that this isn't a current issue but could still be useful info later.