FitGirl Repacks Calls for Expert Malware Review, Warns Users to Exercise Caution

UPDATE: FitGirl Names HEROSKEEP as Malware Distributor

Following the publication of FitGirl Repacks’ initial call for expert malware analysis, a subsequent update has been posted on FitGirl’s official site providing further clarification on the investigation.

In the follow-up post, FitGirl explicitly identifies the repacker operating under the name “Heroskeep” as the source of the suspected malware distribution. According to the update, community-assisted analysis and manual inspection confirmed the presence of malicious mining payloads embedded within multiple repacks attributed to this uploader.

The update states that the affected releases were distributed through major torrent platforms and that extracted installer components were found to deliberately drop cryptocurrency mining executables when executed. FitGirl notes that the behavior observed goes beyond automated false positives and reflects intentional payload delivery.

FitGirl reiterates that users should avoid running installers from unknown or unverified repackers and warns that similar activity may reappear under different uploader names in the future. The advisory emphasizes continued caution rather than focusing solely on a single distributor.

Initial Issue

Prominent game repacker FitGirl has issued a public request for assistance from the malware analysis community after identifying what she believes may be serious security threats embedded in releases from another repacker. The call for help was published on FitGirl’s official site on January 13, 2026.

Rather than presenting a final verdict, the post makes one thing clear: the potential threat is significant enough that FitGirl is seeking independent, third-party, expert verification from experienced analysts. For users who regularly download repacked games, this alone is a meaningful warning signal.

Warning to Users

FitGirl is widely known for being conservative when it comes to security-related issues. It is uncommon for her to publicly escalate concerns without substantial preliminary work. The decision to request outside confirmation suggests that the suspected behavior goes beyond routine false positives or noisy antivirus detections.

For end users, particularly those accustomed to downloading repacks from multiple sources, the key takeaway is simple: exercise heightened caution. Until the situation is clarified by qualified analysts, downloading unfamiliar or unverified repacks carries increased risk.

What She’s Investigating

According to the post, FitGirl made an initial analysis and she believes that certain repacks may be bundling cryptocurrency miners or other malicious components. She does highlight, however, that definitive proof requires further expert review.

The suspected payloads are described as using advanced evasion techniques, potentially avoiding detection in standard virtual machines or sandboxed environments. This is one of the reasons the matter has been escalated to professionals capable of handling live malware safely.

To support the investigation, FitGirl assembled a dataset (approximately 280 MB) intended strictly for analysts (I’m not touching that with a 50-foot pole). It includes:

• A FreeArc archive sourced from the repacks under investigation, reportedly containing around 40 executables packed with commercial protectors such as VMProtect or Themida
• A Python-based extraction script (Python 3.10+) designed to recover executables using PE header detection
• Decompiled bytecode from an Inno Setup installer, suspected of playing a role in payload delivery

FitGirl explicitly warns that these materials should not be handled casually and are not meant for general users.

Community Feedback and Investigations

Importantly, the original post does not name the repacker being investigated. Any names circulating in comment sections, forums, or third-party discussions originate from community speculation rather than FitGirl’s official statement.

Following the post, discussions have intensified, with users sharing automated analysis reports and debating whether the detections represent real malware or false positives caused by game files and aggressive packers. Some comments suggest administrative actions may be taking place within repacking communities, though these claims remain unverified.

At this stage, the situation remains unresolved. FitGirl’s request for expert validation is still active, and the outcome will depend on reproducible findings from independent analysts, not automated scans alone. Sorry, VirusTotal.

Final Thoughts

This is not a confirmation of malware distribution. It is, however, a warning to my audience who sails the high seas.

When a major repacker publicly calls on malware professionals to verify suspected threats, users should take notice. Until independent analysis settles the matter, the safest course of action is to avoid unfamiliar repacks and treat the situation with caution.