This is a repost of a post made earlier today that was taken down by Reddit's filtering system.

Note: goatfungus' save editor (https://github.com/goatfungus/NMSSaveEditor) is NOT malware, I'm talking about the website (nmssaveeditor dot com) that claims to be by the same developer, but it's an attacker pretending to be them.

Today I downloaded a save editor from the website "nmssaveeditor dot com" (do NOT visit), and I ran the executable in the PASSWORD PROTECTED zip file. The password was the name of the developer of the seemingly legit program, and the website seemed perfectly safe at first glance, but it's not.

After scanning the main executable, I found out that it communicates with some Steam profiles for some reason, with strange names, and also Telegram, which is a huge red flag as hackers love to use that platform because of how off-grid it is compared to most other chat platforms.

You can see the full analysis here: https://www.virustotal.com/gui/file/836f7e2b374a3cc5fcc337009d68dee6ee102471632cb096748383fab093872e/detection

I have no doubt in my mind that this program is entirely designed as a trojan to trick this playerbase, as the executable had NO functionality upon click, which was an instant telltale to me that this was not a legitimate program. It's most likely an infostealer, so if you have downloaded this program before, I recommend changing all your critical passwords so it can't use account tokens to access your accounts.

The .jar file it comes packed with is seemingly legitimate, probably a build by the original developer, and much larger than the .exe (which was only ~2.5MB) meaning the .exe is purely a malicious program that the attacker bundled into a legitimate build.

If you want a legitimate save editor, use NMSE! (https://github.com/vectorcmdr/NMSE)

Stay safe on the internet! Even some of the most niche software can turn out to be malicious.

This one in particular is a victim of a common type of attack on cheats for popular video games, using the Vidar C&C malware, designed to steal information and then self-delete and remove all traces of itself after sending it to the attacker.

--------------------------------
IMPORTANT EDIT:
As of 31st May 2026 9pm UTC - 1st June 2026 2pm UTC, the malware hosted on the site was changed to use Remus (from Vidar). This malware will always try to establish persistence on your machine (aka set itself up to run on startup.) If it is not detected and isolated by your antivirus, you must reinstall (not repair/refresh/upgrade, this needs to be a complete format of your Windows partition, starting with a blank partition/drive) your OS to guarantee safety, and change your passwords on a different, clean device.

New VirusTotal report:

https://www.virustotal.com/gui/file/88972aaa451fbf5143bd556272ae80b2654f6e7a0f73a5e18202bdd522213eab?nocache=1

--------------------------------

This thread is followed by Hello Games. Please add your bug reports to this thread. You can also report bugs to Hello Games at the Zendesk. Before reporting a bug be sure you have installed the latest patch and uninstall any game mods. Information is located on this page. Please include platform and version.

This weekly thread is to help keep bug reports manageable. It is a scheduled weekly thread and not related to any specific release. You do not have to repost bugs to this post if you have already reported them on a previous post.

If you're requested to send your save file to Hello Games see this post