I've made a few intentionally ambiguous posts about Terraria because I was trying to get nerds who do stuff with it to give a fuck. Turns out they don't give a fuck in any capacity whatsoever so I'll just go full disclosure. When someone brought it to tModloaders attention they said it isn't a big deal. Okie dokie In Terraria there is a mod called tModloader. It is available for download on Steam. If someone hosts a game and has tModloader installed, and the person joining (the client) has tModloader installed, the client will arbitrarily download the mods used by the game host. Very cool However, if the game host has malicious mods installed then the client who joins the host will arbitrarily execute the malicious mod with no prompting. The malware payload will run in the context of tModloader. This has been used on and off since roughly 2016. There are dozens of posts about it on places like Reddit, Discord, and Steam. Some nerds have considered making a "tModloader sandbox" to prevent mods from being able to access components outside scope of Terraria. Unfortunately, nothing has been done to prevent this and/or encapsulate mods. Obviously there is no "signing" mechanism for mods. The host being able to execute mods on the client. Hence, it is not a vulnerability. It is a feature which is being abused. This technique has been used most recently for cryptodraining malware campaigns (akin to spear phishing). It has been used historically to deploy RATs and information stealing malware. The technique requires some social engineering to convince someone to join the host, however that is not particularly difficult. I have a working proof-of-concept. It isn't hard at all. It's shockingly easy. Thanks for coming to my TED Talk. Thank you Telegram nerds for giving me code, proof-of-concepts, and explanation on how it works. I initially discussed it on Telegram and dozens of nerds came forward to share their insights, opinions, and code.