Call of Duty: WW2 pulled from PC following reports of remote code exploit trolling players with 'Notepad pop-ups, PC shutdowns' and desktop wallpaper of a lawyer

Activision has pulled a specific PC version of Call of Duty: WW2 just days after release, following reports that the game suffers from a remote code execution (RCE) exploit. This affects the so-called "Xbox PC" version of COD: WW2 that was just released on PC Game Pass: the game remains available on Steam and through Battle.net, though perhaps now is not the time to try it out.

RCE exploits are not about in-game cheats or hacks: rather they allow attackers to run nefarious code on a user or organisation's machines via the game software. Online security firm Invicti defines an RCE as "a vulnerability that lets a malicious hacker execute arbitrary code in the programming language in which the developer wrote that application. The term remote means that the attacker can do that from a location other than the system running the application." They're also sometimes called "code injection" attacks.

The upshot is that these are among the nastiest cyber-attacks out there, and several sources have offered evidence they're happening. Streamer Wrioh posted this clip to X, in which their game of WW2 freezes, dialogue boxes pop up, and then their desktop wallpaper is changed to show a man's face. User @LasagneManne claims to have been given the opportunity to buy this exploit and shares a screen showing the software's various options as well as RCE, including more 'traditional' cheats like kicking players and enabling God Mode.

Gamers are going ballisticCall of Duty WWII, available on Xbox PC Game Pass, contains an unpatched RCE exploitSomeone is trolling gamers with Notepad pop ups, PC shutdowns, and gay pornography pic.twitter.com/FLNzRbLt1sJuly 3, 2025

VX-Underground admin "Smelly" then goes on to provide a detailed explanation of what they think is "probably" happening in Wrioh's clip (because they're analysing it purely from the video without logs etcetera). The TL;DR is that "the concern in this particular case is that this means an attacker is capable of deploying information stealer malware, a RAT (remote administration tool), or ransomware. Thankfully, it appears this attacker is primarily interested in memeing and fucking with people."

VX-Underground also notes that the desktop background "is changed to show a prominent lawyer who Activision hired to prosecute video game cheaters."

Activision hasn't directly addressed the reports of the RCE exploit, saying only that the 2017 shooter has been "brought offline" while it investigates "an issue."

TOPICS

Rich is a games journalist with 15 years' experience, beginning his career on Edge magazine before working for a wide range of outlets, including Ars Technica, Eurogamer, GamesRadar+, Gamespot, the Guardian, IGN, the New Statesman, Polygon, and Vice. He was the editor of Kotaku UK, the UK arm of Kotaku, for three years before joining PC Gamer. He is the author of a Brief History of Video Games, a full history of the medium, which the Midwest Book Review described as "[a] must-read for serious minded game historians and curious video game connoisseurs alike."

You must confirm your public display name before commenting

Please logout and then login again, you will then be prompted to enter your display name.