It appeared that some form of malware was attempting to call various ad platforms through the Rainway servers. Since the company whitelists URLs internally, the calls were generating errors and had “the unintended side effect of shining a light on a much broader issue.” It also provide engineers with a URL that they later used to identify the source of the malware.

Sifting through thousands of YouTube videos on Fortnite hacks, and subsequently hundreds of cheat programs, the team finally found a hack that used the URL that kept turning up in its logs. The software claimed to provide the player with an aimbot and a way to generate free V-Bucks (Fortnite’s in-game currency).