Security Alert: Fake Pokémon Snap PC Recomp on GitHub Drops Windows Trojan

The explosive momentum of the open-source PC porting scene—driven by groundbreaking static recompilation frameworks like N64Recomp, Zelda 64: Recompiled, and Star Fox 64 Recompiled—has created unprecedented excitement among retro gaming fans. Enthusiasts eagerly search GitHub, Reddit, and social media daily for news of their favorite childhood titles escaping hardware purgatory.

Unfortunately, cybercriminals have taken notice.

A new fraudulent GitHub project claiming to be a native PC port of HAL Laboratory's 1999 Nintendo 64 classic—titled Snap64Recomp (hosted at harshithmothilal/Snap64Recomp)—is actively distributing a dangerous Windows Trojan infostealer. Posing as an authentic N64Recomp and RT64 project complete with an elaborate, AI-crafted README, the repository is designed to trick nostalgic players into running malicious binaries on their PCs.

The Forensic Teardown: What's Actually Inside the Repo

At first glance, the repository mimics the presentation of genuine decompilation and recompilation releases. The author presents an extensive guide explaining how to dump your legal Nintendo 64 cartridge, configure controller mappings, and toggle widescreen rendering. But peeling back the curtain reveals a textbook malware drop:

1. Zero Actual Source Code

Authentic recompilation projects consist of thousands of lines of C/C++ code, disassembly configs, CMake build trees, and submodules linking to upstream graphics layers. In contrast, Snap64Recomp contains exactly two tracked items:

• A marketing README.md designed to fool search engines and casual browsers.
• A single zip archive stashed under an obscure subfolder: resistor/Snap-Recomp-v3.6.zip (487 KB).

2. The Trojan Payload

Inspecting the contents of Snap-Recomp-v3.6.zip reveals no emulator engine, no SDL libraries, and no RT64 graphics backend. Instead, the archive contains only three files:

• Application.bat (24 bytes)
• cli.exe (760 KB)
• skey.txt (184 KB)

Opening Application.bat reveals a simple one-line launcher intended to evade basic antivirus heuristic scanners:

start cli.exe skey.txt

3. Threat Classification: Malware.Win32.Generic.cld

A cryptographic hash verification of the executable confirms its malicious nature:

• Binary Name: cli.exe
• SHA256: c434ce8620057d9dd9073b4af8382bf27e85729d152164909f1052775e7ddc70
• Classification: Malware.Win32.Generic.cld / Trojan Infostealer (frequently compiled under names like zen.exe)
• Payload Role: The companion file skey.txt contains encrypted configuration parameters, command-and-control (C2) server addresses, and execution flags passed directly into the binary at launch.

The Social Engineering Trap: Weaponizing AI for Credibility

What makes this campaign particularly insidious is how thoroughly the threat actors used large language models (LLMs) to manufacture an aura of authenticity.

The documentation goes to great lengths to disarm skeptical retro gamers:

• Clean-Room Legal Theater: It prominently insists that "Snap64Recomp does not include any Nintendo game data, so you need to provide your own copy of Pokémon Snap"—mimicking the strict legal hygiene practiced by legitimate preservation projects to avoid DMCA takedowns.
• Authentic Technical Jargon: It accurately describes real N64 technical hurdles, mentioning 320x240 native rendering, .z64 and .n64 byte-swapped ROMs, NTSC vs. PAL timing, and controller deadzones.
• Forged Git History: The commit log even features a forged attribution: Co-Authored-By: Claude Fable 5.1 <[email protected]>, exploiting the community's awareness that frontier AI models are widely used for binary reverse engineering.

What the Malware Does: Infostealer Mechanics

When an unsuspecting player double-clicks Application.bat expecting to photograph wild Pikachu at 60 FPS, the script executes cli.exe silently in the background without launching any game window. The malware belongs to the broad family of commodity Windows infostealers (similar to Lumma, RedLine, and Vidar), which perform rapid automated reconnaissance:

1. Browser Credential Theft: Scrapes saved passwords, autofill databases, credit card numbers, and session cookies from Chromium-based browsers (Chrome, Edge, Brave, Opera) and Firefox.
2. Session Hijacking: Targets active session tokens for Discord, Steam, Telegram, and social media platforms, allowing attackers to bypass multi-factor authentication (MFA) via cookie replay.
3. Cryptocurrency Wallet Theft: Scans local storage for popular browser wallet extensions (MetaMask, Phantom) and cold wallet data files.
4. System Fingerprinting: Gathers hardware UUIDs, IP addresses, running processes, and installed software, packaging the collected archives into an encrypted payload transmitted back to a remote C2 server.

Incident Response: What to Do If You Ran It

If you or someone in your community downloaded and launched files from harshithmothilal/Snap64Recomp, treat your machine as fully compromised:

1. Isolate Immediately: Disconnect your PC from the local network (unplug Ethernet or disable Wi-Fi) to cut off active exfiltration channels.
2. Run Offline Antivirus Scans: Boot into Windows Safe Mode or use a dedicated rescue USB (such as Microsoft Defender Offline or Malwarebytes) to purge the infection and lingering registry persistence entries.
3. Revoke Sessions & Change Passwords: From an uncompromised secondary device (like your phone), immediately change passwords for critical accounts: Google, Microsoft, Discord, Steam, email, and financial services. Make sure to click "Log out of all other sessions" to invalidate stolen session cookies.
4. Reset Discord & Steam Tokens: Changing your Discord and Steam passwords automatically regenerates your authentication tokens, locking out unauthorized attackers.

The Preservation Field Guide: How to Spot Fake Recomp Ports

As the static recompilation movement continues to flourish, fake repositories will only become more common. Keep these essential security rules in mind whenever exploring new retro ports:

The retro gaming community is built on trust, open collaboration, and technical passion. By staying vigilant and verifying the code behind the hype, we can keep game preservation safe for everyone.