‘Final Fantasy XIV’ Modder Purposely Injects Malware Into GShade, Prompting User Backlash

Tyler Valle |

Feb 14, 2023

My own screenshot from in game with an added logo and "Malware" text.

In the last week, the Final Fantasy XIV community has been rocked by several controversies revolving around the use of mods, but one has had far more serious repercussions than the rest – a popular program called GShade. Originally, it was a spin-off of the open-source tool called ReShade, commonly used to inject enhanced lighting and other effects into various PC video games.

It has been around since 2014, and entered open-source in 2017, shortly after a Final Fantasy XIV-focused version had been in development, aptly named GShade. This tool has been a mainstay in the Final Fantasy XIV community for years, allowing players to dress up their screenshots and share them with others. Even I partook in the use of the program over my last four years playing the game.

ReShade allows for shaders and effects to be layered on top of a base game to visually enhance it. This is a screenshot of my character with ReShade turned off (Left) and turned on (Right) in Final Fantasy XIV.

Unfortunately, this is no longer possible after a serious of bizarre and illegal choices made by the developer in response to their rivalry with another modder. Users noticed something bizarre in the most recent GShade update early Monday morning. Several lines of code had been added that would allow GShade to take control of the user’s PC and shut it down without the user’s consent. In other words, GShade was purposefully transformed into malware.

Yes, this is the kind of bullshit that GShade is working on, rather than bothering to implement a more sensible update system. The installer RESTARTS YOUR SYSTEM if it detects it's not being run "properly". Continued… pic.twitter.com/3eacb6RH5U

— perchbird (@perchbird_) February 6, 2023

In a public Discord conversation, GShade developer “Marot-Satil” explained what had happened and why.

Users took issue with the very idea that they would be given malware, without their knowledge, by the developer. More ominous was the statement, “Anything could have been in the payload and you’d have been responsible for distributing it to people and triggering it.” The developer says that they have the ability to inject even more dangerous code at a whim, while also taking no responsibility for their actions, instead putting it onto another modder by the name of NotNite.

NotNite has been working on their own version of ReShade that could import the settings from GShade, something Marot-Satil was very much against. After this statement became public, the community was in an uproar. GShade was trending on Twitter as thousands of users revolted against the developers, announcing their intentions to remove the program immediately. The official GShade discord server went into lockdown and began to ban people who spoke up against the developer.

A side-by-side comparison of Arfien's GShade mod running on FFXIV

Eventually, the backlash became so severe that the team associated with the developer was forced to make a public apology and announce a new update that removed the malware from GShade, but the damage had been done. It is important to emphasize that this wasn’t an apology from the developer – rather just the people who shared a community with the developer, and were dragged down with them.

Most of the community was already in the process of replacing GShade with one of the several alternatives. All the good will that the developer had built over the last several years was instantly wiped out.

On Tuesday morning, it was announced that GShade was officially dead after an investigation by Github found that the program was in violation of the terms of service, and was subsequently terminated. Because GShade used an always-online DRM service to constantly ping Github for updates, the program no longer worked. Unless of course, users downloaded the unofficial update by modder NotNite, the developer who had been the target of the GShade creator. That program would save user installations, as well as remove malware.

A screen grab of FFXIV running Alex's GShade Preset, via Nexus Mods

This is a story of ego ruining the career and reputation of a once well-respected content creator in the Final Fantasy XIV community, all within the space of a scant 24 hours. In the end, the target of their actions has thrived, while gaining a positive reputation within the community. Expect more tools and resources to follow that benefit players as time goes by.

NEXT: ‘Final Fantasy XVI’ Producer On The Game’s Alleged Lack Of Ethnic Diversity: “We Simply Want The Focus TO Be Less On The Outward Appearance Of Our Characters”