“Gaming mods” and cheating systems are used to target players in malware campaigns.
On Wednesday, researchers from Cisco Talos said that gaming tools are being used to develop cryptor – code designed to prevent reverse-engineering or analysis – for a variety of malware strains, most of which appear to be remote access Trojans (RATs).
See also: Over 60% increase in ransomware and IoT malware detections
The attack wave is focused on compromising the systems of players and modders. The initial attack vector begins with a malicious advertisement – ads that lead to malicious websites or downloads – as well as YouTube instructional videos focused on game modding that are linked to malicious content.
There is already a vibrant market for cheats and mods. Online gaming is a multi-million dollar industry, so some players will go so far as to purchase “cheats” to give them an advantage.
See also: Mac devices were hit with more malware last year than ever before
Developers have also stepped up their game and often upload their creations to VirusTotal to see if files are flagged as suspicious or malicious.
The risk of downloading system modification files is nothing new, and the latest campaign is common.
Cheaters, cheat engines, and mods containing cryptors have been found to be able to hide RAT code and backdoors through multiple layers of obfuscation. Once a malicious mod or cheat is downloaded and installed on a targeted machine, a dropper injects code into a new process to bypass basic antivirus tools and detection algorithms.
See also: Purple Fox malware with worm capabilities infects Windows systems!
The malware can then be executed. Samples tracked so far include the deployment of XtremeRAT, an information stealer that has been associated with spam campaigns, and the deployment of Zeus variants.
Information source: zdnet.com
