It all started when a user on the site GTAForums noticed some strange activity when running a routine check of what processes were running on their computer. Eventually the user tracked down the suspicious activity to Fade.exe, which had hijacked another file and was using it to connect to the Internet.
More investigation and a Malwarebytes scan revealed that the program in question was actually a keylogger. The culprit turned out to be the popular GTA V mod Angry Planes, which spawns, well, angry planes that incessantly hunt down the player.
To double check, the user removed Fade.exe and the other files that it spawned while running, then loaded up GTA V with the Angry Planes mod and watched as the process once again popped into existence. Other users quickly began to do their own testing and confirmed the mod did indeed contain the malware.
Users also identified another mod, No Clip, that had been installing the same malware. In response, popular site GTA5-Mods.com plans to “beef up the approval process on these kinds of scripts.”
“If you post compiled scripts in .asi, .dll, or .net.dll formats, the approval process will be much lengthier,” a post on the site explains. “We recommend avoiding these formats completely and publishing your mods as .lua or .cs source files, these kinds of scripts will be approved very quickly because the source can be verified.”
For more information on how to check if your system is infected, see the post on GTAForums. In the meantime, you may want to be extra careful when installing mods, whether for Grand Theft Auto V or other games.
