Gamers Being Targeted For Malware Delivery

In a recent discovery, cybersecurity researchers have identified a malicious campaign targeting gamers seeking game cheats online. This malware, written in Lua, is disguised within popular cheat scripts and is designed to establish persistence on infected systems, allowing attackers to deliver further harmful payloads. The trend underscores the growing risk for gamers who download cheats and mods from unverified sources.

Understanding the Vulnerability

The malware, known as a Lua-based loader, leverages the popularity of Lua script-based gaming engines like Solara and Electron. According to Morphisec researcher Shmuel Uzan, the malware has gained traction across North America, South America, Europe, Asia, and Australia. Hackers are exploiting the gaming community’s interest in game cheats by luring users to download malicious files hosted on GitHub, a legitimate code-sharing platform.

Initially documented by OALabs in early 2024, the campaign involves creating fake websites that appear in search results for popular cheats and mods. These sites then redirect users to GitHub repositories hosting infected ZIP archives, which contain malware disguised as legitimate files. These ZIP files include a Lua compiler, a DLL file, an obfuscated Lua script, and a batch file, all of which execute on the user’s machine when opened.

The malicious Lua script reaches out to a command-and-control (C2) server, which can then push additional payloads, including credential-stealing malware like RedLine and CypherIT. This setup enables attackers to access sensitive user data, from login credentials to system information, with potentially damaging consequences.

Who Is at Risk?

1. Gamers Seeking Cheats and Mods

• The primary targets of this campaign are gamers, particularly students and younger users who frequently look for free cheats and mods to enhance their gaming experience. By searching for terms like “cheat engine,” they unwittingly expose themselves to these malicious sites.

2. General Internet Users

• Though primarily aimed at the gaming community, the techniques used here could easily be adapted to lure other user groups. Any user searching for free or hacked versions of popular software, especially those hosted on open-source platforms like GitHub, is at risk.

3. Organizations Allowing Unmonitored Software Downloads

• This malware can infect any system that allows users to download and execute unverified programs. Organizations that do not enforce strict download controls may inadvertently expose themselves to data breaches or network compromises if employees install such malware.

How to Protect Yourself

1. Avoid Downloading Game Cheats from Unverified Sources

• Download cheats, mods, and gaming enhancements only from official or reputable sources. Be cautious of search results that lead to unknown sites or direct you to GitHub repositories without proper verification.

2. Check File Sources Carefully

• Avoid downloading files that are hosted on third-party platforms like GitHub without verifying the user or organization behind them. Review comments, feedback, and reputational scores for GitHub accounts before trusting any downloadable content.

3. Use Security Software

• Ensure that your system is equipped with updated antivirus or endpoint protection that can detect malicious scripts and unauthorized data transmissions. Security programs can identify suspicious processes, such as those initiated by hidden scripts or unexpected connections to C2 servers.

4. Monitor for Unusual System Activity

• Malicious programs often cause irregular system performance, such as sudden spikes in CPU or network usage. If you notice your system slowing down or behaving abnormally, disconnect from the internet, perform a malware scan, and seek professional assistance if needed.

5. Employ URL Filtering and Web Security Controls

• Organizations can protect users by deploying web filtering solutions that restrict access to known malicious sites. URL filtering can prevent access to fake websites hosting malware-laden files, adding an extra layer of security to prevent such infections.

What Platforms Are Doing to Mitigate These Attacks

GitHub has begun taking steps to combat this abuse by disabling user accounts and content in accordance with their Acceptable Use Policies, which prohibit hosting or distributing malware. The platform is also investing in additional security measures to help better identify and take down malicious repositories. However, given the open-source nature of GitHub, these types of campaigns may continue to surface. Collaboration between security researchers, platforms, and users will be essential in mitigating these risks.

Conclusion

The rise of malware disguised as gaming cheats highlights the importance of being cautious with downloads, even from popular platforms like GitHub. Gamers and other users looking to enhance their experience through mods or cheats need to be vigilant, as malicious actors exploit these searches to gain access to personal data. By avoiding unverified sources, using reliable security software, and regularly monitoring system activity, users can significantly reduce their risk of falling victim to such attacks.