Unidentified Malware Campaign Targets Call of Duty Cheaters, Drains Bitcoin Wallets

A sophisticated malware campaign has emerged, specifically targeting video gamers, including those engaged in cheating, leading to significant Bitcoin wallet losses. According to vx-underground, a malware information repository, this new wave of attacks has been orchestrated by an as-yet-unidentified threat actor. The campaign, disclosed in a March 28 X post, exploits vulnerabilities associated with pay-to-cheat video game software to siphon off login credentials and other sensitive information.

Scope of the Attack

The malware has compromised the accounts of over 4.9 million users of Activision Blizzard and its digital distribution platform, Battle.net. Additionally, it has infiltrated user accounts on the game-focused trading site Elite PVPers and cheat software markets such as PhantomOverlay and UnknownCheats. Victims of the campaign have reported substantial financial losses, with their Electrum Bitcoin wallets being specifically targeted and emptied. The precise amount of stolen funds remains undisclosed.

Responses from Affected Parties

PhantomOverlay, in a March 27 Telegram announcement, contested the reported number of hacked accounts, suggesting that the figures might be exaggerated. The malware, described as part of a network of free or inexpensive software, appears to have originated from applications widely used by the gaming community, such as latency programs or VPNs. PhantomOverlay described the campaign as “the largest infostealer malware campaign in gaming/cheating community history.”

Further investigation by PhantomOverlay has led to speculative identification of the malware’s source. However, the implicated malware group has reportedly taken steps to obscure its involvement, complicating efforts to conclusively attribute the attack.

Collaboration with Activision Blizzard

In response to the escalating situation, Activision Blizzard has reached out to PhantomOverlay, offering assistance to the millions of users potentially affected by the malware. The company has reassured its user base, via a statement to Cointelegraph, of the integrity and security of its servers, urging those concerned about their account safety to change their passwords as a precautionary measure.

The malware’s impact was initially detected following reports of unauthorized transactions made from compromised user accounts. This prompted PhantomOverlay to alert the community and begin identifying additional victims of the attack.

This malware campaign highlights the heightened risks associated with downloading and using unauthorized software, particularly within the gaming and cheating communities. It underscores the importance of maintaining strict cybersecurity practices and vigilance against seemingly benign applications that could serve as conduits for malicious activities. As the investigation continues, the collaborative efforts between affected platforms and companies like Activision Blizzard are crucial in mitigating the fallout and safeguarding the digital assets and personal information of millions of users.