What an HWID spoofer actually does
When Marvel Rivals launches under Easy Anti-Cheat, the anti-cheat agent reads a long list of hardware identifiers and hashes them into a single fingerprint. The fields include the Windows MachineGuid, the SMBIOS system serial and UUID, drive serials, the MAC addresses of physical NICs, the BIOS vendor string, and a handful of less obvious values like the GPU device path. A hardware ban does not literally lock your motherboard; it adds the hash of that fingerprint to the ban list. A spoofer changes the inputs going into that hash so the next account starts with a clean identity.
The Nimbus launcher Spoofer tab exposes three controls: One-Shot Spoof (user-mode rewrite of about eight HKLM keys including MachineGuid and HwProfileGuid), Kernel Spoof (invokes the signed-driver KDU backend to rewrite SMBIOS and storage-device IDs that user-mode code cannot reach), and a stress harnessthat reboots five times and re-checks that the rewritten values survived. Everything happens inside the launcher process; there is no second binary to chase.
Why standalone spoofers are almost always the wrong tool
The standalone HWID-spoofer market on YouTube and the wider cheat-forum scene is overwhelmingly low-trust. The supply chain looks like this: a Discord server links a MEGA archive, the archive is password-protected so antivirus engines cannot scan it inline, the included binary is packed with Themida or VMP, the binary asks you to disable SmartScreen and Defender before it runs, and the install instructions tell you to run as administrator. That is the exact behaviour profile of a coin miner or credential stealer. Some are legitimate; many are not; you cannot tell the difference from the YouTube comments.
If you still want to roll the dice on a standalone, the minimum-effort safety checks are: upload the binary to VirusTotal before running, look at the “behaviour” tab for keylogger / clipboard / wallet-folder access, and run it in a Windows Sandbox or disposable VM first. If any of those steps fail, the file is not safe.
What a spoofer cannot do
A spoofer does not unban your existing account — bans are tied to the NetEase identity, not the hardware. See our ban-recovery write-up for the honest take on what happens after a ban. A spoofer also does not stop Marvel Rivals from collecting future telemetry; it only changes what identity is attached to that telemetry. And it cannot retroactively scrub network-side identifiers like the IP address or Steam ID. The play is spoof + fresh account + fresh Steam family share, not spoof + existing banned account.
For background on how EAC fingerprinting actually works, see Marvel Rivals EAC explained and our HWID reset guide — the latter walks through migrating a working Nimbus license to a new machine without burning a reset.
Where to go next
Buy a $5 day pass and you have the Spoofer tab in your hands within a minute of license redemption. The side-by-side comparison shows how the Spoofer tab stacks up against what other Marvel Rivals loaders ship by default.