Nefarious Malware Campaign Targets Gamers, Stealing Bitcoin

A new malware campaign targets gamers using game cheats and has compromised 4.9 million Activision Blizzard accounts. The malware steals login credentials and drains Bitcoin (BTC) wallets, with reports of stolen funds. The malware reportedly originates from a network of free or low-cost software widely used by gamers and may be the largest info-stealer campaign in gaming history. PhantomOverlay, a cheat software provider, claims the number of hacked accounts is inflated, but acknowledges the malware's significant impact on the gaming community. Activision Blizzard is assisting infected users and recommends password changes.

Unveiling a Nefarious Malware Campaign Targeting Gamers with Bitcoin Theft

A widespread malware threat has emerged, targeting video gamers and draining their Bitcoin (BTC) wallets, cybersecurity experts have warned. This malicious campaign, part of an intricate info-stealing operation, has also spread its reach to individuals seeking illegitimate advantages in gaming through cheating software.

Vx-underground, a reputable repository for malware information, reported on March 28 that an "unidentified Threat Actor" is employing malware to purloin login credentials and other sensitive data from those utilizing pay-to-cheat video game software.

Under this assault, gamers, including those indulging in cheating software, have become easy victims. The malware's insidious reach has breached over 4.9 million accounts belonging to Activision Blizzard users and its Battle.net game store, along with accounts on Elite PVPers, a game-focused trading site, and PhantomOverlay and UnknownCheats, markets for cheat software.

"Affected users have come forward, reporting the devastating consequence of their Electrum BTC wallets being emptied by this malware," vx-underground revealed. "As of now, we do not have an estimate of the financial losses incurred."

Source: vx-underground

PhantomOverlay, in a Telegram post dated March 27, expressed concerns about the inflated number of compromised accounts, stating that over half of the login credentials obtained from a reviewed database were invalid.

They further elaborated that the malware appears to be "an extensive network of free/cheap software" originating from "some latency program, VPN, or a tool prevalent among millions of gamers."

"This represents the most extensive infostealer malware campaign ever witnessed in the gaming and cheating community," PhantomOverlay asserted.

In a subsequent update, PhantomOverlay hinted at having "a strong inkling about the malware's source." However, the malware gang has become aware of their suspicions and has taken evasive measures, making it challenging to substantiate their claims.

Activision Blizzard has reportedly reached out to the cheat-selling site, PhantomOverlay, expressing a commitment to assisting "millions of infected users," as stated by PhantomOverlay.

An Activision Blizzard representative confirmed to Cointelegraph that they have become aware of reports indicating that credentials "across the broader industry could be jeopardized from malware resulting from unauthorized software downloads or use."

Stressing that their servers "remain secure and intact," Activision Blizzard strongly advises users to update their passwords to safeguard their accounts.

According to vx-underground's post, PhantomOverlay was alerted to suspicious activities when user accounts began making unauthorized purchases. PhantomOverlay subsequently contacted the presumed victim, leading to the identification of additional victims.