Behind every cheat that makes its way into a Call of Duty match is a larger economy built on resellers, rebranded tools, illicit accounts, and customers handing over far more information than they realize.
From the outside, cheating in Call of Duty can look pretty simple.
Someone downloads a cheat, manipulates their controller input, loads into a match, and ruins the experience for everyone else. What most players never see is the business behind that moment.
Cheat sellers have built a sprawling, multi-billion-dollar marketplace of resellers, subscription services, cheat reskins, illicit accounts, spoofing tools, and organized distribution networks.
Because cheating across the industry is sustained by vast, organized illicit networks, the RICOCHET Anti-Cheat team doesn’t approach the fight one account at a time. We confront the cheating business from multiple angles, targeting the infrastructure, distribution networks, and operators that keep the cheating economy alive.
RICOCHET Anti-Cheat combines detections, account security, TPM 2.0 enforcement, deep investigations, and legal action to combat this market. Each layer targets a different part of the market: cheats and cheating behaviors, replacement accounts, hardware and evasion attempts, distribution networks, and the people operating them.
A February analysis by the threat intelligence platform Intorqa estimated that cheat subscriptions across 15 games generate roughly $3.5 billion annually. When adjacent industries -- such as account sales, boosting, spoofing, and other services -- are included, Intorqa forecasts the broader cheating economy at about $8.5 billion each year.
Cheat developers sit at the top of the illicit marketplace pyramid.
Although some operate publicly, many deliberately hide behind intermediaries, using resellers and support teams to shield themselves from customers. They keep distance from direct sales, marketing, and distribution channels that would expose them. Below them, primary vendors move the products into the market. They sell cheats directly to customers and supply resellers who expand the reach of the operation.
Beneath that, layers of resellers push the same products through overlapping storefronts, communities, and distribution channels. #TeamRICOCHET tracks hundreds of these vendors. Developers can profit from a broad distribution network while resellers handle the customer-facing work that creates exposure.
Sellers also create an illusion of endless variety. In reality, many “different” cheats are the same product wearing a different logo, name or storefront.
We've paired technical detection with sustained legal action to destabilize the cheat ecosystem at every level. We've disrupted more than 375 reseller operations, issued more than 80 cease-and-desist demands, and helped shut down 31 primary cheat vendors.
Legal action directly attacks the revenue, payment channels, and business relationships that keep those operations running, making the business of cheating increasingly difficult to sustain.
Players feel that impact when cheat providers go offline or a cheater can’t get back into a match. What may look like a random cheat outage or reseller disruption is often a sign of pressure moving through the cheating economy.
Cheat sellers often use marketing tactics and social posts to make their operations look stable, even when they are under significant pressure. We’ve seen cheat developers use social platforms to explain months of downtime with excuses like “the flu,” “surgery,” or a “car accident” rather than acknowledge their products were detected and no longer reliable.
Those messages are part of the playbook they use to reassure customers while our systems continue disrupting their networks.
The Three Pillars of the Market
The cheating ecosystem relies on three connected categories: cheats, accounts, and evasion. Each one feeds the others, and together they keep the broader operation moving.
Cheats
This is the category most players recognize first.
Aimbots. Wallhacks. Rage cheats. Unlock tools. DMA-based cheating hardware. External devices and tools designed to manipulate gameplay, including Cronus, XIM, and Titan.
Cheat sellers package access in different ways: monthly subscriptions, weekly access fees, or premium packages.Sellers often market these products as “private,” “custom,” or “exclusive,” even when reseller chains distribute the same tools widely across the market.
RICOCHET Anti-Cheat fights these tools through a layered approach. Technical detections look for unauthorized software interacting with the game, while behavioral systems analyze gameplay over time for patterns associated with automated assistance, helping inform investigations and enforcement against the accounts using them.
Accounts
Cheaters need accounts. When enforcement removes those accounts from circulation, the market immediately tries to replace them.
Demand has created an economy around stolen accounts, aged accounts, Ranked Play-ready accounts, and boosting services.
That market exists against a broader backdrop of account theft. The Consumer Financial Protection Bureau cited research of 10,000 gamers globally in which one in three said their gaming account had been hacked within the previous two years.
As account security improves, replacements become harder to acquire and more expensive to rely on. Our two-factor authentication requirements help protect players from account compromise while reducing the supply of disposable or stolen accounts that bad actors use to re-enter the game after enforcement.
Hardware-backed protections add another layer of friction. TPM 2.0, Secure Boot, and Remote Attestation help establish trust before a match begins by verifying the integrity of the PC. Together, stronger account security and device integrity checks push cheaters toward more expensive services and raise the overall cost of staying active inside the ecosystem.
Evasion
The third pillar supports repeat offenders trying to avoid detection and hardware-based enforcement.
Sellers offer spoofers, evasion tools, and related services to help cheaters reenter the ecosystem after enforcement action. As enforcement evolves, those sellers keep searching for ways to bypass it. Our behavioral and technical detections, paired with updated security requirements like Microsoft Azure Attestation, help us fight those efforts.
RICOCHET Anti-Cheat's protections make it harder for these spoofers to get through, and our improved hardware banning capabilities keep bad actors out. Last month, we issued more than 70,000 new hardware bans as part our ongoing fight against cheating.
Each pillar supports the others. When pressure hits one part of the market, instability spreads across the whole ecosystem.
False Variety
One of the biggest misconceptions about the cheat market is that players have access to a wide range of unique products. Many developers sell the same cheats under different names. In some cases, the person selling a cheat did not create it. Resellers can buy, reuse, modify, or steal source code, then repackage it under a new brand. The same cheat may appear under multiple brand names at the same time, and sellers benefit from that confusion because it helps detected products survive longer, fragments communities discussing bans, and creates the appearance of innovation where very little exists.
The reseller market also creates room for scams. Vendors disappear after collecting payments in “exit scams” or go quiet during major detection periods, claiming they were targeted by legal action, then rebrand and reopen somewhere else.
The ecosystem runs on misinformation almost as much as it runs on software and hardware, which is why we target not only primary vendors but also the resellers who try to reskin detected cheats.
What Cheat Sellers Really Get From Their Customers
Cheat sellers do more than sell software. They also collect data from customers who willingly disable security protections, putting them and their systems at risk.
Many cheat communities require users to verify accounts before accessing private forums or downloads, using authentication schemes that can expose real IP addresses, linked Discord accounts, hardware information, email addresses, payment details, and other identifying information. Other vendors go further, requiring photo identification as part of onboarding.
Cheat developers also embed malware in their products.
Raising the Cost of Cheating
Cheating is expensive, and pressure on the ecosystem drives that cost higher.
Subscription cheats can cost around $40 per month on average, and upwards of $100 on the higher end. Spoofers add another recurring fee. That means one bad actor could spend more than $1,000 per year just to cheat. DMA-related hardware and services drive the cost even more.
Over the course of one year, some players spend hundreds of dollars — if not thousands — trying to maintain access to cheats, evasion tools, and replacement accounts.
Ultimately, cheating is a losing investment. Every time we identify and remove a bad actor, the money they spent cheating goes with them — all for a temporary ego boost. RICOCHET Anti-Cheat keeps making cheating harder, riskier, and more expensive to sustain. Our layered systems add friction across the market, and that pressure changes behavior.
The ecosystem keeps changing. So do we.
