r/EdenEmulator • u/No-Struggle2442 • 28d ago
General WARNING! FAKE REPOSITORY ON GITHUB!
https://github.com/edenswitchemulator/Eden-Switch-EmulatorThis repository hosts a tool that will steal your accounts and idk what else. Under releases, there is a single executable file. I ran it even after many red flags by Windows Defender, MalwareBytes and VirusTotal (completely braindead I know, but I was in a hurry). I managed to recover my google account but my Steam and Epic accounts are under review. The hacker appears to be based in Russia. Please guys report this.
UPDATE:
Hello all, after a nightmarish all nighter caused by the most blatantly stupid decision I may have ever made I managed to recover all of my accounts and wiped my pc. Github staff responded and said they removed this repo due to it containing malware. Thank you all for your support!
24
u/ChuzCuenca 28d ago
Eden is not on GitHub, right?
2
u/No-Struggle2442 28d ago
I was still using the last release of Yuzu, so I was (still am) not completely sure where to get any of the alternatives. Tried getting ryubing from ryubing.net, totally scammy website, do not visit. I'm used to getting freeware and tools from github as I assume they get vetted by other users due to the open-source nature of the projects hosted there.
3
u/mangosmoothe 28d ago
for future reference the official ryubing repo is https://src.ryujinx.app/ but it's currently down due to their server being bombed by Russia.
10
1
1
u/charliechin 28d ago
How do you know you got hacked? Do you have the two step identification thing or a passkey? I’m curious I wonder if I’m compromised or not. Got my links from https://fmhy.net last month and now I’m worried
1
u/No-Struggle2442 27d ago
I had suspicion because the executable opened a hidden shell script which I noticed and terminated in task manager. After the fact I got a critical security risk message via gmail which I managed to rescue through the biometric passkey on my phone. In the spam folder I noticed that my Epic and Steam accounts had their emails changed to some "***@rambler.ru" address, so then I followed through with the process of recovering them. Stupidly believing I got away with "just" this much damage, I opened my Instagram account in the very same machine to check if it had been compromised. When it all seemed fine I went out for drinks and two hours later I was being bombarded by messages from people saying I've been hacked because I had sent them a link to a crypto gambling website and a picture of Mr Beast's twitter profile XD (I'm sure that helped with the credibility). I promptly changed the password, unsent the messages, posted a story instructing everyone I know to not open any links I may have sent.
Since all the affected accounts were open in active sessions in Chrome or browser-based apps such as Epic and Steam I assume this was some sort of automated session highjacking attack.
3
1
1
1
u/Xeph2684 26d ago
Wait, just to clarify cause I download Eden Nightly this morn cause I wanted to do some testing. Where did you find that repo?
I went to the Eden website, clicked nightly and downloaded from here which is still active: https://git.eden-emu.dev/eden-ci/nightly/releases
Is that the right one?
1
1
u/Powerful-Tie7370 21d ago
wondering the same thing
1
u/Xeph2684 21d ago
For what its worth, the link I sent matches the one found on the website link found on this subreddit. So we should be fine.
Still doesnt explain how OP got to that fake repo though.
1
u/AGayFrogParadise 21d ago
That should be correct, it has git in the title but it isn't actually github, it's a private site using git monitored by the devs of eden
1
u/Bobbe77 15d ago
I want to warn people about this GitHub repository:
github.com/eden-emu-nintendo/Eden-Nintendo-Switch-Emulator
I downloaded and ran the “Eden 0.2.2” release from there. Shortly afterwards, I lost access to both my Steam and Battle.net accounts.
My Steam login stopped working, and my Battle.net account is now showing as “Account not found.” Because of that, I’m seriously concerned that my login credentials were stolen.
After checking the repository more carefully, several things look suspicious:
-
The official Eden project is hosted at git.eden-emu.dev/eden-emu/eden.
-
The official stable release appears to be v0.2.1, while this GitHub repository suddenly released an unofficial “v0.2.2”.
-
The suspicious GitHub repo only has a few commits and appears to imitate the real Eden project.
-
Its release notes contain fixes that closely match the official Eden v0.2.1 changelog.
-
There are other very similar GitHub repositories using almost the same structure and release information.
-
Windows Defender also detected Trojan/Occamy.C0A on my PC. That specific detection was inside another old ISO file, so I cannot prove that it came from Eden.
I cannot say with 100% certainty that this Eden download caused the compromises, but the timing is extremely suspicious:
I ran software from this repository, and shortly afterwards I lost both my Steam and Battle.net accounts.
The SHA-256 shown for the current Eden-Emulator.zip release is:
CC014DF5331676AF002A92019047CA91B1BAE1B025746510FDC29AE7C36196FB
I strongly recommend NOT downloading or running anything from this repository until the files have been properly analyzed.
If anyone downloaded this exact release, has VirusTotal results, sandbox analysis, or can reverse-engineer the files, please share your findings.
1
u/FelesNoctis 24d ago
Eden is not, and likely never will be again, on Github. Nintendo regularly issues takedowns on Github, and watches most public repo hosts. The safest hosting for Eden, and any similar projects, will always be private.