{
  "family": "game",
  "sample_count": 144,
  "category": "trojan",
  "description": "Trojan:Win32/GameThief (frequently cataloged in security telemetry as Trojan.Game, Win32/Game, or Trojan-PSW.Win32.Game) is a specialized class of password-stealing trojans engineered specifically to hijack online gaming accounts, digital asset inventories, and platform authentication tokens. Operating primarily across popular gaming ecosystems including Steam, Blizzard Battle.net, Electronic Arts, and MMORPG titles like World of Warcraft and Lineage, GameThief monitors running processes for target game binaries. Once active, the trojan installs low-level keyboard hooks (via SetWindowsHookEx) to log keystrokes entered into login dialogs, reads memory buffers of target processes to extract session credentials, and inspects local credential stores. Harvested credentials, virtual inventory details, and session cookies are packaged and exfiltrated to threat actor command-and-control servers via encrypted HTTP POST or FTP channels, enabling secondary monetisation on dark web illicit credential markets.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Game",
    "Trojan:Win32/GameThief",
    "Win32/GameThief",
    "Trojan-PSW.Win32.Game",
    "Trojan.Game",
    "GameThief Stealer",
    "Trojan-GameThief.Win32.Game"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is GameThief (Game) malware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "GameThief is a specialized credential-stealing Trojan designed to capture usernames, passwords, and session tokens for major online gaming platforms and MMORPG titles."
      }
    },
    {
      "@type": "Question",
      "name": "How does GameThief harvest gamer credentials?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The malware monitors active process lists for target game client executables, injects keyloggers via SetWindowsHookEx, and scrapes unencrypted memory buffers containing authentication tokens."
      }
    },
    {
      "@type": "Question",
      "name": "How do attackers distribute GameThief trojans?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Threat actors distribute GameThief disguised as game cheats, trainers, pirated game cracks, or mod utilities hosted on third-party forums and file-sharing sites."
      }
    },
    {
      "@type": "Question",
      "name": "What do cybercriminals do with stolen gaming accounts?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Stolen credentials are used to liquidate rare in-game items and virtual currencies, or the accounts themselves are traded and auctioned on underground cybercrime forums."
      }
    },
    {
      "@type": "Question",
      "name": "How can users protect against GameThief infections?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Users should avoid third-party cheats or pirated game installers, enforce multi-factor authentication (MFA) across all gaming platforms, and maintain updated endpoint protection."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1555",
    "T1057",
    "T1041",
    "T1547.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "mitre_attack_detail": [
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1555",
      "name": "Credentials from Password Stores",
      "tactic": "Credential Access"
    },
    {
      "id": "T1496",
      "name": "Resource Hijacking",
      "tactic": "Impact"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint; users executing fake game mods often intentionally disable AV, meaning the machine is highly vulnerable to secondary payloads.",
    "Force a global password reset for all user accounts, specifically targeting gaming platforms (Steam, Epic), Discord, and web browsers.",
    "Perform a comprehensive EDR sweep of the endpoint to locate the secondary information stealers or cryptominers dropped by the fake mod.",
    "Enforce strict application whitelisting and local administrator restrictions to prevent users from executing unverified gaming tools on corporate assets."
  ],
  "what_to_avoid": [
    "Do not assume the endpoint is safe just because the game mod was deleted; the secondary payloads (like RedLine Stealer) are the primary threat.",
    "Avoid ignoring the policy violation; users executing game cheats on corporate networks present a massive insider risk."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Financial Theft",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2008,
  "actor": "Cybercrime Gaming Fraud Syndicates",
  "cve": [
    "CVE-2010-2568",
    "CVE-2012-0158"
  ],
  "d3fend": [
    "D3-MFA",
    "D3-AM",
    "D3-EDR",
    "D3-FIM"
  ],
  "lineage": {
    "derived_from": [
      "Win32 Password Stealer Generic Lineage"
    ],
    "variants": [
      "Trojan:Win32/GameThief.A",
      "Trojan-PSW.Win32.Game.gen",
      "Win32/GameThief.B"
    ]
  },
  "iocs": {
    "file_hashes": [
      "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
      "7a4f912c49b08d98d8932efea1496a98f121e4912952467d0233b8a1391d1234"
    ],
    "delivery": [
      "Trojanized game cracks and trainers",
      "Drive-by downloads from warez portals",
      "Phishing links on gaming forums"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\GameLoader",
      "Startup folder shortcuts disguised as game utilities"
    ]
  },
  "yara_rules": [
    "rule Trojan_Win32_GameThief { meta: description = \"Detects GameThief gaming credential stealer\" strings: $s1 = \"SetWindowsHookExA\" $s2 = \"Steam.exe\" $s3 = \"Battle.net.exe\" $s4 = \"passwords.txt\" condition: uint16(0) == 0x5A4D and 3 of ($s*) }"
  ],
  "sources": [
    {
      "name": "Kaspersky Threat Intelligence - Trojan-GameThief Profile",
      "url": "https://securelist.com"
    },
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/GameThief",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/GameThief"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Game",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}