Researchers at major video game publisher Activision have discovered a new malware program that installs hidden cryptocurrency miners on users PCs by masquerading as a “trainer” for Call of Duty: Warzone, the company revealed yesterday.
“In March of 2020, a threat actor posted on multiple hacking forums advertising a free, ‘newbie friendly’, and ‘effective’ method [to cheat], for spreading a remote access trojan (RAT)—malware that primarily does what it implies, provides remote access for a threat actor to the target it is delivered to,” said the researchers.
Per the report, the RAT was presented as a “trainer”—a program that ostensibly allows players to activate various cheats—for popular battle royale-style multiplayer shooter Call of Duty: Warzone.
However, what gamers actually downloaded was a “dropper”—a piece of software designed to stealthily download and install various malware.
“The dropper examined in this report, ‘Cod Dropper v0.1,’ can be customized to install other, more destructive, malware onto the targets machines,” the report explained.
No pain, no gain
The hackers advertised their malware as an “undetected cheat for COD WARZONE” and even published some YouTube videos with instructions, urging gamers to disable their security software and give the RAT high system privileges.
“The actor's suggested method for convincing the victims to disable their protections is made significantly easier by advertising their RAT as a video game cheat. It is common practice when configuring a cheat program to run it with the highest system privileges,” the report noted.
Among other malware, the dropper installed several hidden cryptocurrency miners on its victims systems, although the researchers did not specify what digital assets they were producing.
Notably, the hackers “target audience” was likely chosen intentionally. Since CoD: Warzone is a pretty demanding game in terms of its system requirements, there is a higher probability that victims would have a powerful graphics card—which would make crypto mining faster and more effective.
“While this method is rather simplistic, it is ultimately a social engineering technique that leverages the willingness of its target (players that want to cheat) to voluntarily lower their security protections and ignore warnings about running potentially malicious software,” the researchers concluded.