Sergey

Over the past couple of days we have become aware of malware targeting gamers! More specifically, a currently unidentified Threat Actor is utilizing an infostealer to target individuals who cheat (Pay-to-Cheat) in video games. A Call of Duty cheat provider (PhantomOverlay) was alerted of fraudulent activity when user accounts began making unauthorized purchases. The cheat provider was the first to notice the fraudulent activity and reached out to the suspected victim. Since the initial victim was identified, more and more victims have been identified. The scope of the impact is so large, and in a bizarre twist of fate, Activision Blizzard is coordinating with cheat providers to aid users impacted by the massive infostealer campaign. Currently there is a presumed impact of: - 3,662,627 Battlenet accounts compromised - 561,183 Activision accounts compromised - 117,366 Elite PVPers accounts compromised - 572,831 UnknownCheats accounts compromised - 1,365 PhantomOverlay accounts compromised When Elite PVPers was approached by PhantomOverlay administrative staff about the compromised accounts, Elite PVPers confirmed they have identified 40,000+ valid user accounts compromised. These are seemingly freshly stolen credentials and are not present from previous publicly available credential dumps. However, due to the size of the data we have not been able to thoroughly review the data for duplicates. Additionally, impacted users have begun reporting being victims of crypto-draining – their Electrum BTC wallets have been drained. We do not have any information on the amount of money stolen.