邪惡的惡意軟體活動以遊戲玩家為目標，竊取比特幣

一項新的惡意軟體活動利用遊戲作弊手段針對遊戲玩家，已損害了 490 萬個動視暴雪帳號。該惡意軟體竊取登入憑證並耗盡比特幣 (BTC) 錢包，並報告資金被盜。據報道，該惡意軟體源自遊戲玩家廣泛使用的免費或低成本軟體網絡，可能是遊戲史上最大的資訊竊取活動。作弊軟體供應商 PhantomOverlay 聲稱被駭帳號的數量有所誇大，但承認該惡意軟體對遊戲社群產生了重大影響。動視暴雪正在協助受感染的使用者並建議更改密碼。

Unveiling a Nefarious Malware Campaign Targeting Gamers with Bitcoin Theft

揭露針對遊戲玩家的惡意惡意軟體活動，竊取比特幣

A widespread malware threat has emerged, targeting video gamers and draining their Bitcoin (BTC) wallets, cybersecurity experts have warned. This malicious campaign, part of an intricate info-stealing operation, has also spread its reach to individuals seeking illegitimate advantages in gaming through cheating software.

網路安全專家警告說，一種廣泛的惡意軟體威脅已經出現，其目標是視訊遊戲玩家並耗盡他們的比特幣（BTC）錢包。這項惡意活動是複雜的資訊竊取行動的一部分，其影響範圍也擴大到透過作弊軟體在遊戲中尋求非法優勢的個人。

Vx-underground, a reputable repository for malware information, reported on March 28 that an "unidentified Threat Actor" is employing malware to purloin login credentials and other sensitive data from those utilizing pay-to-cheat video game software.

信譽良好的惡意軟體資訊儲存庫 Vx-underground 於 3 月 28 日報道稱，「身份不明的威脅行為者」正在利用惡意軟體從使用付費作弊視訊遊戲軟體的用戶那裡竊取登入憑證和其他敏感資料。

Under this assault, gamers, including those indulging in cheating software, have become easy victims. The malware's insidious reach has breached over 4.9 million accounts belonging to Activision Blizzard users and its Battle.net game store, along with accounts on Elite PVPers, a game-focused trading site, and PhantomOverlay and UnknownCheats, markets for cheat software.

在這種攻擊下，遊戲玩家，包括那些沉迷於作弊軟體的玩家，很容易成為受害者。該惡意軟體的陰險影響範圍已侵入動視暴雪用戶及其 Battle.net 遊戲商店的超過 490 萬個帳戶，以及遊戲交易網站 Elite PVPers 以及作弊軟體市場 PhantomOverlay 和 UnknownCheats 上的帳戶。

"Affected users have come forward, reporting the devastating consequence of their Electrum BTC wallets being emptied by this malware," vx-underground revealed. "As of now, we do not have an estimate of the financial losses incurred."

vx-underground 透露：“受影響的用戶已經站出來，報告了他們的 Electrum BTC 錢包被該惡意軟體清空的毀滅性後果。” “到目前為止，我們還沒有對所造成的財務損失進行估計。”

Source: vx-underground

來源：vx-underground

PhantomOverlay, in a Telegram post dated March 27, expressed concerns about the inflated number of compromised accounts, stating that over half of the login credentials obtained from a reviewed database were invalid.

PhantomOverlay 在 3 月 27 日的 Telegram 貼文中表達了對受感染帳戶數量膨脹的擔憂，並表示從審查的資料庫中獲得的登入憑證中有一半以上無效。

They further elaborated that the malware appears to be "an extensive network of free/cheap software" originating from "some latency program, VPN, or a tool prevalent among millions of gamers."

他們進一步闡述說，該惡意軟體似乎是“一個廣泛的免費/廉價軟體網路”，源自於“一些延遲程序、VPN 或數百萬遊戲玩家中流行的工具”。

"This represents the most extensive infostealer malware campaign ever witnessed in the gaming and cheating community," PhantomOverlay asserted.

PhantomOverlay 斷言：“這代表了遊戲和作弊社區中有史以來最廣泛的資訊竊取惡意軟體活動。”

In a subsequent update, PhantomOverlay hinted at having "a strong inkling about the malware's source." However, the malware gang has become aware of their suspicions and has taken evasive measures, making it challenging to substantiate their claims.

在隨後的更新中，PhantomOverlay 暗示「對惡意軟體的來源有強烈的了解」。然而，惡意軟體團夥已經意識到他們的懷疑並採取了規避措施，這使得證實他們的說法變得困難。

Activision Blizzard has reportedly reached out to the cheat-selling site, PhantomOverlay, expressing a commitment to assisting "millions of infected users," as stated by PhantomOverlay.

據報道，動視暴雪已經聯繫了作弊銷售網站 PhantomOverlay，並承諾幫助“數百萬受感染的用戶”，正如 PhantomOverlay 所說。

An Activision Blizzard representative confirmed to Cointelegraph that they have become aware of reports indicating that credentials "across the broader industry could be jeopardized from malware resulting from unauthorized software downloads or use."

動視暴雪的一位代表向 Cointelegraph 證實，他們已經注意到有報道稱，「整個行業的憑證可能會受到未經授權的軟體下載或使用所產生的惡意軟體的危害」。

Stressing that their servers "remain secure and intact," Activision Blizzard strongly advises users to update their passwords to safeguard their accounts.

動視暴雪強調他們的伺服器“保持安全和完整”，強烈建議用戶更新密碼以保護他們的帳戶。

According to vx-underground's post, PhantomOverlay was alerted to suspicious activities when user accounts began making unauthorized purchases. PhantomOverlay subsequently contacted the presumed victim, leading to the identification of additional victims.

根據 vx-underground 的帖子，當用戶帳戶開始進行未經授權的購買時，PhantomOverlay 就會收到可疑活動的警報。 PhantomOverlay 隨後聯繫了假定的受害者，從而確認了其他受害者的身分。