Bitcoin-Stealing Malware Targets Fortnite Gamers

The release of season six for the popular Fortnite video game has inspired the development of bitcoin-stealing malware disguised as game cheating tools.

Malwarebytes Labs has discovered malware disguised as cheat tools that can steal data and bitcoinfrom Fortnite gamers, according to Christopher Boyd, the lead malware intelligence analyst. Malwarebytes Labs found the malware among YouTube videos offering “free” season passes and offers for “free” Android versions of the game, Boyd noted in a blog post.

Multiple Steps To Getting Scammed

Finding the malware required going through numerous steps, including subscribing to a YouTubechannel, getting prompted to a different site, then taking a survey before downloading the malware.

One video was titled, “New Season 6 Fortnite Hack Cheat Free Download September 2018 / WH / Aimbot/ Undetectable.” One was titled, “Fortnite Hack Free Download,” while another was titled “Fortnite Cheat.”

One video racked up 120,892 views before being removed for violating YouTube’s spam policy, noted Boyd, who also observed that disguising malware as a cheat tool is not a new technique, but one that can do a lot of damage.

Also read: Malware discovered sending fake emails to steal bitcoin and passwords

Plenty Of Data Vulnerable

When the initial .exe file runs on the target system, it enumerates details of the infected computer, Boyd noted. It then sends data by means of a POST command to a file in the Russian Federation. A lot of data can be stolen, as the malware examines bitcoin wallets, Steam sessions, cookies, and browser session information. A readme file advertises the ability to purchase additional Fortnite scams for “$80 bitcoin.”

Boyd advised anyone tempted to cheat at Fortnite to steer clear of the numerous offers available.

“Offering up a malicious file under the pretense of a cheat is as old school as it gets, but that’s never stopped cybercriminals before. In this scenario, would-be cheaters suffer a taste of their own medicine via a daisy chain of clickthroughs and (eventually) some malware as a parting gift,” he wrote. “Winning is great, but it’s absolutely not worth risking a huge slice of personal information to get the job done.”