One of the largest Korean "anticheat" companies also sells cloud antivirus and reuses the same code signing certificate for their anticheat rootkit. I've seen a few outright change DNS resolvers to themselves instead of just looking at cache too.