--- title: What this "Pscyhological Horror Game" is really doing... description: A YouTuber walks through reverse-engineering a fake indie horror game used as a Discord token/crypto stealer scam. Using an AnyRun sandbox alongside an AI... canonical: https://daily.dev/posts/what-this-pscyhological-horror-game-is-really-doing-ft-kimi-k3--far08oent twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: What this "Pscyhological Horror Game" is really doing (FT Kimi K3) | daily.dev og:description: A YouTuber walks through reverse-engineering a fake indie horror game used as a Discord token/crypto stealer scam. Using an AnyRun sandbox alongside an AI... og:url: https://daily.dev/posts/what-this-pscyhological-horror-game-is-really-doing-ft-kimi-k3--far08oent og:image: https://api.daily.dev/og/posts/faR08oENt.png og:image:alt: What this "Pscyhological Horror Game" is really doing (FT Kimi K3) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # What this "Pscyhological Horror Game" is really doing (FT Kimi K3) **[Eric Parker](https://daily.dev/sources/ericparker)** · 25 min read · 0 upvotes · 0 comments ## Summary A YouTuber walks through reverse-engineering a fake indie horror game used as a Discord token/crypto stealer scam. Using an AnyRun sandbox alongside an AI agent (Kimi K3 via Codex harness) for static analysis, he peels back an NSIS installer, an Electron app, embedded 7-Zip archives, obfuscated JavaScript (base64+XOR), and a Java payload decompiled with Vine Flower. The final payload turns out to be a multi-function infostealer/RAT with Discord client injection, crypto wallet clipping, keylogging, ransomware capability, UAC bypass, and startup persistence, wrapped in a fake 'network error' decoy screen. He also demonstrates how AI-assisted static analysis (writing markdown reports, auto-deobfuscating scripts) speeds up the workflow, and checks VirusTotal detection rates for each stage of the payload. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does the fake Discord game scam malware actually work technically? It ships as an NSIS installer that extracts via 7-Zip into an Electron app, which drops a base64/XOR-obfuscated JavaScript payload and an embedded Java runtime containing a jar. The Java component (nicknamed X Stealer internally) performs Discord client injection to steal tokens, backup codes, passwords, and credit cards, alongside crypto wallet clipping, keylogging, a UAC bypass, ransomware capability, and startup persistence, while showing a fake network error as a decoy. _Teams tracking emerging infostealer techniques can follow deep technical breakdowns like this on daily.dev._ ### How well do antivirus engines detect this Discord token stealer malware disguised as an indie horror game? Detection was inconsistent across the payload stages: the launcher got only two hits on VirusTotal, the Electron/exe stage came back fully clean, and only the final obfuscated Java stealer jar was flagged, by ESET, while Trend Micro, Bitdefender, and Microsoft Defender missed it on static scan. Behavior-based engines like Bitdefender would likely still catch it at runtime by recognizing infostealer behavior patterns. _Security practitioners comparing AV detection gaps for new malware families can track findings like this on daily.dev._ ### Can AI coding agents like Kimi K3 be used for malware static analysis? Yes, an AI agent (Kimi K3 run through a Codex harness) was used to automate deobfuscation of a multi-stage malware payload, including writing Python scripts to strip base64/XOR encoding, stepping through nested obfuscation layers, and producing a markdown report summarizing indicators of compromise. It sped up analysis significantly but still required human verification at each stage rather than being a fully automated solution. _Developers evaluating AI agents for security tooling workflows can follow real-world use cases like this on daily.dev._ ## Similar posts on daily.dev - [Fake Roblox Xeno script launcher pushes infostealer, RAT malware](https://daily.dev/posts/fake-roblox-xeno-script-launcher-pushes-infostealer-rat-malware-qtwjss6dl) · BleepingComputer · 0 upvotes · 0 comments - [Fake games spread stealers with RenPy Loader, MSBuild and EtherHiding](https://daily.dev/posts/fake-games-spread-stealers-with-renpy-loader-msbuild-and-etherhiding-zkfrqypzs) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#malware](https://daily.dev/tags/malware), [#discord](https://daily.dev/tags/discord), [#reverse-engineering](https://daily.dev/tags/reverse-engineering), [#kimi](https://daily.dev/tags/kimi) [View this post on daily.dev](https://daily.dev/posts/what-this-pscyhological-horror-game-is-really-doing-ft-kimi-k3--far08oent) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"What this \"Pscyhological Horror Game\" is really doing (FT Kimi K3)","url":"https://daily.dev/posts/what-this-pscyhological-horror-game-is-really-doing-ft-kimi-k3--far08oent","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/what-this-pscyhological-horror-game-is-really-doing-ft-kimi-k3--far08oent"},"datePublished":"2026-08-12T17:23:00.701Z","dateModified":"2026-08-12T17:23:27.110Z","description":"A YouTuber walks through reverse-engineering a fake indie horror game used as a Discord token/crypto stealer scam. Using an AnyRun sandbox alongside an AI...","image":"https://i.ytimg.com/vi/NfCmla7gAJ4/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/NfCmla7gAJ4/sddefault.jpg","isAccessibleForFree":true,"articleSection":"Eric Parker","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Eric Parker","logo":"https://media.daily.dev/image/upload/s--vVcOpkjx--/f_auto/v1724391603/logos/ericparker","url":"https://daily.dev/sources/ericparker"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/what-this-pscyhological-horror-game-is-really-doing-ft-kimi-k3--far08oent","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,malware,discord,reverse-engineering,kimi","timeRequired":"PT25M","video":{"@type":"VideoObject","name":"What this \"Pscyhological Horror Game\" is really doing (FT Kimi K3)","description":"A YouTuber walks through reverse-engineering a fake indie horror game used as a Discord token/crypto stealer scam. Using an AnyRun sandbox alongside an AI...","thumbnailUrl":"https://i.ytimg.com/vi/NfCmla7gAJ4/sddefault.jpg","uploadDate":"2026-08-12T17:23:00.701Z","duration":"PT25M","url":"https://api.daily.dev/r/faR08oENt","embedUrl":"https://www.youtube.com/embed/NfCmla7gAJ4"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Eric Parker","item":"https://daily.dev/sources/ericparker"},{"@type":"ListItem","position":3,"name":"What this \"Pscyhological Horror Game\" is really doing (FT Kimi K3)"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/what-this-pscyhological-horror-game-is-really-doing-ft-kimi-k3--far08oent#faq","mainEntity":[{"@type":"Question","name":"How does the fake Discord game scam malware actually work technically?","acceptedAnswer":{"@type":"Answer","text":"It ships as an NSIS installer that extracts via 7-Zip into an Electron app, which drops a base64/XOR-obfuscated JavaScript payload and an embedded Java runtime containing a jar. The Java component (nicknamed X Stealer internally) performs Discord client injection to steal tokens, backup codes, passwords, and credit cards, alongside crypto wallet clipping, keylogging, a UAC bypass, ransomware capability, and startup persistence, while showing a fake network error as a decoy. Teams tracking emerging infostealer techniques can follow deep technical breakdowns like this on daily.dev."}},{"@type":"Question","name":"How well do antivirus engines detect this Discord token stealer malware disguised as an indie horror game?","acceptedAnswer":{"@type":"Answer","text":"Detection was inconsistent across the payload stages: the launcher got only two hits on VirusTotal, the Electron/exe stage came back fully clean, and only the final obfuscated Java stealer jar was flagged, by ESET, while Trend Micro, Bitdefender, and Microsoft Defender missed it on static scan. Behavior-based engines like Bitdefender would likely still catch it at runtime by recognizing infostealer behavior patterns. Security practitioners comparing AV detection gaps for new malware families can track findings like this on daily.dev."}},{"@type":"Question","name":"Can AI coding agents like Kimi K3 be used for malware static analysis?","acceptedAnswer":{"@type":"Answer","text":"Yes, an AI agent (Kimi K3 run through a Codex harness) was used to automate deobfuscation of a multi-stage malware payload, including writing Python scripts to strip base64/XOR encoding, stepping through nested obfuscation layers, and producing a markdown report summarizing indicators of compromise. It sped up analysis significantly but still required human verification at each stage rather than being a fully automated solution. Developers evaluating AI agents for security tooling workflows can follow real-world use cases like this on daily.dev."}}]} ```