How Sims 4 mod malware works

Most mods are fine. But since January 2024 there have been repeated, real attacks through mods and custom content, and they follow a few simple patterns.

Why a mod can hurt your computer at all

There are two kinds of mod files, and they carry very different risk.

• .package files hold game data: meshes, textures and tuning. The game reads them, so they are not a known way to run code. Plain CC is all .package.
• .ts4script files are zip archives of Python code, and the game runs that code when it loads. Python running on your computer can do what any program can. The game does not check these files, and EA does not review mods. Ordinary antivirus often does not look inside them either, because the code is compressed and compiled.

Sims 4 script mods only run if "Script Mods Allowed" is ticked in the game options. Almost everyone who uses mods has it on.

The three patterns

1. A script that downloads a program

This is the main attack. A .ts4script carries a little extra code. When you start the game with it installed, it quietly downloads and runs an .exe. You see nothing. In 2024 that program stole browser passwords and cookies, saved cards, Discord tokens, Steam and Telegram data and crypto wallets, as F-Secure described. Because the payload was a Windows program, reports said Mac players were not affected, though a Mods folder copied to a Windows machine can still spread it.

2. A script added where it does not belong

In March 2026, attackers took over ModTheSims accounts and added a .ts4script to uploads of objects and recolors. Plain CC never needs a script, so a new script file in a CC download is the warning sign.

3. A program instead of a mod

In April 2025, stolen SimFileShare accounts had their downloads replaced with a zip holding only install.exe or install.bat. No game involved: the damage happens if you run it. Sims 4 CC is never an .exe. The same idea appeared in a January 2025 Discord message campaign that sent people to a program download.

How the accounts get hit

• Hacked real creators. Your favourite creator's page updates, but the creator did not do it. Their mod was fine yesterday.
• Lookalike accounts. A new account uses a famous creator's name with a small change, and posts a "new version".
• Stolen mods. A clean mod is reuploaded elsewhere with something added.

The incidents so far

This list comes from community warnings, not a complete record. Names of mods in it often have clean originals, and hacked creators are victims. The Sims After Dark archive and Crinrict's summary are good places to check for newer ones.

Two things that are not mods at all

• Fake "verify you are human" pages. One player reported a fake Cloudflare check on a CC site that went full screen and copied a command to their clipboard, asking them to paste it. Never paste a command because a web page told you to.
• Antivirus flags on one file. A single warning can be a false alarm. It can also be real, so check before deciding. Do not just turn off the antivirus to install a mod.

How to lower your risk

• Open each zip before extracting. Look for .exe, .bat, or a .ts4script in something that should only be CC.
• Get mods from the creator's own page. Check the name for small misspellings and be wary of new accounts.
• If an update appears with no notes, wait a few days and check the creator's other pages.
• Do not download a whole Mods folder from someone else.
• Use ModGuard by TwistedMexi, a free mod that blocks common attack methods while the game runs. It is a different kind of protection from this page, which reads files before you use them. ModGuard's author says it is not a guarantee, and it could not stop the April 2025 attack, because that one had no script in it. Neither can replace antivirus.
• Keep passwords in a password manager, not your browser, and turn on two-factor sign-in for email, Discord and Steam.

If you think you ran something bad

1. Close the game. Delete the mod and any recent downloads from the same source, and empty the Recycle Bin.
2. Press Windows key + R, open %AppData%\Microsoft\Internet Explorer\UserData, and look for Updater.exe or main.exe. Also look for out.exe in your Sims 4 install folder. An empty folder does not prove anything, since it is not known whether the malware removes itself.
3. Run a full scan with your antivirus. For the 2024 stealer, Overwolf (owners of CurseForge) published a free cleaner, SimsVirusCleaner. Read what it does first: it also deletes everything in your Windows temp folder.
4. From a different device, change the passwords for your email first, then everything else. Sign out of all sessions where a site offers it. A stolen login cookie can keep working after a password change until you do.
5. Reports say the 2024 stealer attached itself to Discord and crypto wallet apps, so uninstall those and reinstall from a fresh download. Move crypto to a new wallet from a clean device.
6. If cards were saved in your browser, tell your bank.
7. If the scan keeps finding things, a full Windows reinstall is the only sure fix.

Where this comes from

Written from public sources, read in November 2026: the warnings by Sims After Dark and Crinrict, F-Secure's article, the The Sims Resource notice, SimsCommunity and its March 2026 report, The Sims Tree, and the source code of Overwolf's cleaner. We have not examined a real malware sample, and no public technical teardown of these scripts turned up, so details of how each script worked rest on those reports.