He published it at 3:14 AM.

But the message had spread. One of the commenters—username Mishanya_2023 —wrote:

Because in the end, the scariest malware isn’t the one that crashes your game.

He explained how to check for infection (run netstat -an | findstr :4455 ). How to remove the backdoor (wipe and reinstall Windows—no shortcuts). How to report the domains to abuse contacts.

He spun up a fresh Windows VM. No network drives. No shared clipboard. He downloaded the file—a 2.3MB executable named Horion_Installer_legit.exe . The icon was a familiar blue H. So far, so fake.

It was 11:47 PM when Alex first saw the username flash across the Twitch chat.

He remembered the 2022 case where a modified version of Impact client had been used to backdoor Ukrainian energy sector employees who played Minecraft during lunch breaks. Same playbook. Target gamers with admin privileges. Wait. Pivot.

This wasn’t a hack. This was a harvest .