Qakbot as malware really hasn't been reported on since 2023 in any meaningful way, in-fact, in May of 2025, the russian guy behind it got charged by the US government, probably not in custody. The file supposedly named "2025-06-06_b368582164db2129901fff0a9b58212d_helldown_qakbot" matches all hashes with hotscreen.exe, but it seems rather dubious and could easily be someone's attempt at a little bit of trolling since there doesn't seem to be any information relating to qakbot from June of 2025. Helldown could be a bit more plausible, but even that has vague "threat in 2024 and into 2025" articles, nothing indicates that helldown is the same, successor of or even related to qakbot.
Seems more like an attempt to name something that sounds like a virus by combining a date stamp, the file's MD5 hash and two real ransomwares, then passing it off as malware; the only thing I can think of potentially making it sound as plausible and why it got accepted as a file by... and I don't even know how reputable tria.ge is, could be that they list "Suspicious use of SetWindowsHookEx" which... yeah, it hooks into the window creation process to create a transparent overlay, lol. Could be a common way that ransomware also grabs your screen and thus it seems "suspicious" to them.
As far as I know, this is just a Godot project, unless it's somehow got stuff injected and embedded during compilation by PerfectFox265 that I haven't been able to detect. I've combed through the code months ago when attempting to see if I can improve upon the detection myself through the use of (an older version by now) https://github.com/samhaswon/skin_segmentation model and YOLO11n. I can tell you right now that most of Hotscreen is just GDScripts and C# to glue together some DirectML and other libraries for loading and using the detection models. The most suspicious part is hooking into user32.dll, but again, it needs to create a transparent overlay which does require messing around with lower level Win32 APIs. It'd be a hell of lot of effort to create this program as a vehicle for ransomware, when it's kinda niche and has a specific audience, and if it is ransomware, well shit, guess I've been infected for about a year with nothing happening anywhere.
tl;dr - Unless I am tragically wrong, Hotscreen is fine to use.
SluttyJuicyLucy
Recent community posts
I couldn't exactly give a full solution without knowing the source code, but considering https://github.com/PerfectFox265/Safe4Beta, I presume that hotscreen is built with a similar architecture, i.e. a monolith application where Godot handles most of it and .NET is reserved for specialized tasks, i.e. model loading.
If it's not already, I'd see the easiest path as having the .NET layer act as a server that proxies requests to/from Godot, then it may be as easy as using System.Net.WebSockets and/or perhaps even https://github.com/modelcontextprotocol/csharp-sdk
Collection Sharing (Discord Server)
Currently, building a collection is fine and all and in theory it can be shared, but there's nowhere to really share them. While it'd be most ideal within the app itself, that comes with a whole host of issues, such as hosting a server, having the app actually have internet access, etc. As a measure in the meanwhile, perhaps a discord could be setup where people can discuss, share collections, etc. Given that this version is closed source, that would be the most ideal place for everything for the time being.
Text Detection
Given that there already is a feature to have something always visible regardless of the censoring around it, I feel like it should be expanded to detect text as well. Currently, captions, videos with text, just anything with text will get covered by the censor, which isn't a huge deal, especially if you adjust your censored areas to be smaller, but the default 100-110% for example usually doesn't catch stuff well enough, so it's a necessity in my experience to have them sit at 150-200%.
Multi-monitor support
Specifically, multi-monitor support with only one instance of the application running, I can launch multiple instances and cover multiple displays, but that's quirky, leads to having to setup the entire collection beforehand and tweaking it means closing the others, only keeping one open.
Using your own model
Not sure how feasible it is, no clue what DirectML expects, but I was really hoping that I could just drop in a different .onnx model for detection and it just crashed. I'm not bothered by using the shipped model, but it'd be a nice option to have.
Visuals
Not really something that I think needs to be a priority just yet, but a major gripe for me is the use of icons for "Triggered by" and a similar selection and toggle outline. More contrast basically between the elements, color or otherwise, would be great.