"Undetected" is a promise that expires. Here's what cheat developers actually do to keep it true — and what you should look for when choosing a provider.
What Triggers an Update
Three events require a cheat update:
- Game patch — offsets (memory addresses) change when the game binary updates. A cheat reading the old offset reads garbage data or crashes.
- Anti-cheat signature update — VAC/EAC/BattlEye push new signatures that detect previously unknown patterns.
- Ban wave — after mass bans, the detection method is now known and needs to be patched out.
The Offset Problem
Every game build has different memory offsets — the addresses where health, position, and entity data live. Good cheat developers use automatic offset scanners that re-find these addresses after every game update by pattern-matching code signatures instead of hardcoding addresses.
What "Undetected" Actually Means
Undetected = "no detection method currently active for this build." It's not a permanent state. The honest version is time-since-last-ban-wave and update response time.
On Cosmo Cheatz's status page, status is updated within 24 hours of a game patch. If something is marked "Updating," don't run it.
Why External Cheats Update Faster
External builds only need offset updates — no injection code to re-obfuscate, no driver signatures to re-sign. A developer can push an offset-only update in under an hour after a game patch. Internal cheats need full re-obfuscation, which takes 6–48 hours.
All cheats on Cosmo Cheatz are external — this means faster updates and longer undetected windows.
How Hardware Bans Work
Anti-cheats like VAC and BattlEye now issue hardware ID (HWID) bans that persist across accounts. VAC's HWID ban, introduced in 2017, targets the motherboard and storage serial numbers, but not the GPU or CPU. BattlEye bans a broader set: motherboard, CPU, GPU, and network adapter MAC addresses. These bans are stored server-side and checked at game launch. Players often misunderstand that a new Windows install or a VPN does not clear a HWID ban; only replacing the flagged components does. For example, a VAC-banned machine requires a new motherboard and storage drive, while a BattlEye ban may also require a new CPU and GPU. Some cheat providers advertise 'HWID spoofers' that hook the Windows registry and driver calls to present fake serials, but these are detectable by anti-cheats that validate the integrity of the hardware reporting chain. The cat-and-mouse game continues as anti-cheats add checks for known spoofer signatures.
Detecting Cheats via Statistical Analysis
Modern anti-cheats complement signature scanning with statistical analysis of player behaviour. Valve's VAC uses a system called 'VACnet' that runs deep learning models on server-side game data to flag accounts with inhuman accuracy or reaction times. For example, a player with a 90% headshot rate over 100 matches and an average time-to-kill of 50ms will trigger a review. Similarly, BattlEye's 'Stats' module tracks metrics like kills per round, accuracy, and movement patterns, comparing them against percentile baselines. These systems do not ban automatically; they generate cases for manual review or add accounts to a priority list for deeper investigation. Cheat developers counter by adding 'humanization' features that randomise aim smoothing, add reaction delays, and vary shot placement. However, these can be tuned poorly; a cheat with a fixed 100ms delay may still be flagged if the game's baseline for that rank is 200ms. Players often wrongly assume that avoiding blatant aimbots is enough, but statistical outliers in movement or utility usage can also trigger flags.
The Rise of Kernel-Level Anti-Cheats
Kernel-level anti-cheats like Riot's Vanguard (Valorant) and Easy Anti-Cheat's kernel module (Fortnite, Apex Legends) run at the highest privilege level in Windows, allowing them to monitor all system activity. Vanguard, for instance, loads at boot and blocks vulnerable drivers that cheats exploit, such as those from ASUS or MSI that allow arbitrary memory access. This has forced cheat developers to abandon driver-based techniques and move to DMA (Direct Memory Access) hardware, which reads memory from a separate PCIe card. However, Vanguard now detects DMA cards by scanning PCIe configuration space for known vendor IDs. Easy Anti-Cheat's kernel module uses hypervisor detection to catch cheats running in virtual machines. These anti-cheats also block common tools like Process Hacker and Cheat Engine by default. The trade-off is system overhead: Vanguard uses about 1-2% CPU on average, but can cause conflicts with anti-virus software. Users often mistakenly disable the anti-cheat to improve performance, which results in a ban. Verification of kernel anti-cheat integrity can be done via Windows Security settings, where Vanguard appears as a registered security provider.