Most "free" cheat sites are scams — they bundle RAT malware, crypto miners, or just download fake files. Here's how to find cheats that actually work without infecting your PC.
Red Flags to Avoid
- Requires you to complete "human verification" surveys
- Forces you to install a "loader" before showing download
- No VirusTotal link or scan results provided
- Runs only on Windows with admin privileges but no explanation why
- Forum threads with zero replies but high view counts (fake)
How to Verify Before Running
- Download the file
- Go to virustotal.com
- Upload the file — check detections. Under 3 detections on a cheat is usually false positive (heuristics). Over 10 = malware.
- Run in a VM first if you're uncertain
Trusted Sources in 2026
- CosmoCheatz.com — free external cheats for 88+ games, no surveys
- UnknownCheats.me — community forum, open-source releases
- GitHub — open-source cheat projects (verify the code yourself)
Browse all 88 game cheats at CosmoCheatz — no surveys, no miners, just the tool.
How anti-cheat detection actually works
Detection rests on more than file signatures. Easy Anti-Cheat and BattlEye both hash loaded modules and check them against clouds of known-bad binaries, but they also scan process memory for patterns and look at handle access to the game process. Vanguard, used by Valorant and League of Legends, runs as a kernel driver loaded at boot and can block unsigned drivers outright; a cheat that works on an EAC title often fails instantly under Vanguard. Ricochet, deployed in Call of Duty, leans heavily on server-side statistics and replay review rather than local scanning, so an undetected client can still trigger a manual ban weeks later. Faceit AC and ESEA operate their own client checks on top of the game's. Signature-bypass techniques that worked in 2024, such as crude manual mapping, now attract heuristics that flag unusual allocation patterns in memory. This is why a cheat can appear clean on VirusTotal and still be banned within hours.
Why VirusTotal results mislead
VirusTotal aggregates around seventy engines, and that breadth creates two problems. First, engine counts are not equal: a single heuristic hit from a minor engine is not the same as a behavioural detection from a major vendor. Cheat loaders are commonly packed with VMProtect or Themida, which engines flag as suspicious because they cannot unpack the binary, not because anything malicious is inside. Second, VirusTotal never runs the file. A cheat that only drops its payload after connecting to a remote server, or that reads game memory only once a match starts, can show zero detections. Upload the file, then check the Details and Behaviour tabs rather than the headline score. A cheat reporting two detections, both heuristics from lesser engines, is a different proposition from one reporting twelve, several of them named trojans. Also check when the file was first seen; a build uploaded yesterday has had little time to accumulate reports.
Matching cheat versions to game patches
Most failures are version mismatches, not malware. Game updates shift offsets and rebuild structures, and a cheat compiled against the previous patch will usually crash the game, fail to attach, or silently do nothing. Counter-Strike 2 updates frequently and breaks external cheats that rely on hard-coded offsets; players then report the tool as broken when it simply needs the updated build. Verify by checking the cheat's release date against the game's patch history, and prefer tools that display a build number matching the current game version. Some projects state the exact game build they support in a changelog. Test in an offline match or bot lobby first, and watch for the game closing without an error dialogue, which usually points to an access violation rather than a ban. If the menu opens but features do nothing, the memory addresses have changed and the build is stale.