{
  "family": "gamehuck",
  "sample_count": 8,
  "category": "trojan",
  "description": "PWS:Win32/Gamehuck is a highly specialized Password Stealer (PWS) trojan designed specifically to target, harvest, and exfiltrate credentials and valuable digital assets from online gaming platforms (such as Steam, Battle.net, Origin, and various MMOs). The primary motivation behind Gamehuck is financial; stolen accounts with rare in-game items or linked credit cards are rapidly sold on underground forums.<br><br><b>Understanding Gamehuck</b><br>To an end-user, the infection often begins when they download a 'cheat', 'aimbot', or 'currency generator' for a popular video game. The malware operates silently in the background, specifically monitoring for the launch of targeted gaming clients. For security analysts, while Gamehuck might seem like a consumer-focused threat, its presence on a corporate endpoint indicates a severe violation of acceptable use policies and proves that the user is actively bypassing security controls to execute untrusted binaries.<br><br><b>Execution and Credential Harvesting Mechanics</b><br>Gamehuck is almost exclusively distributed via deceptive social engineering on gaming forums, Discord servers, and YouTube videos advertising game hacks (`T1204.002`). Upon execution, the malware establishes persistence via the `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` registry key (`T1547.001`). Its core functionality revolves around credential access (`T1555`). It scans the file system for specific configuration files (like Steam's `ssfn` authorization files) and uses keylogging (`T1056.001`) when the user types their password into the gaming client. Advanced variants also attempt to steal session cookies from web browsers to bypass Multi-Factor Authentication (MFA) on the gaming platforms (`T1539`). The harvested data is then encrypted and exfiltrated to a C2 server or dropped into a Telegram channel (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the loss of personal gaming accounts and potential financial loss, though on a corporate network, it represents a compromised endpoint. IoCs include EDR alerts for keylogging activity (API hooks on `SetWindowsHookEx`) originating from a recently downloaded binary. Network analysts might observe unauthorized FTP or HTTP POST requests containing encrypted archives sent to unusual IP addresses.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Gamehuck and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Gamehuck is classified as a Trojan. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Gamehuck establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Gamehuck typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Gamehuck compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Gamehuck should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads and staging behaviors are commonly associated with Gamehuck?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Gamehuck frequently operates as a loader or dropper designed to establish a foothold before downloading and executing secondary high-impact malware payloads. Depending on the threat actor's objectives, these dropped modules can range from ransomware and banking injects to modular infostealers and remote management backdoors."
      }
    },
    {
      "@type": "Question",
      "name": "How can security operations teams effectively detect and hunt for Gamehuck across enterprise endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Defenders should hunt for Gamehuck by deploying behavioral endpoint detection and response (EDR) rules that monitor suspicious process spawning (such as cmd.exe or powershell.exe spawned from office documents or temporary directories), anomalous outbound network connections from non-browser binaries, and unauthorized modifications to Windows Run keys and scheduled task registries."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1539",
    "T1204.002",
    "T1555"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1555",
      "name": "Credentials from Password Stores (Targeting gaming client configs)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging (Capturing game logins)",
      "tactic": "Collection"
    },
    {
      "id": "T1539",
      "name": "Steal Web Session Cookie (Bypassing MFA)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File (Disguised as game cheats)",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint to prevent further exfiltration of credentials or the download of secondary payloads.",
    "Force a password reset for all corporate accounts used by the individual, as the keylogger may have captured more than just gaming credentials.",
    "Use EDR to locate and terminate the Gamehuck process, and remove the associated Registry Run keys.",
    "Investigate how the user was able to download and execute an untrusted, unapproved binary (the 'game hack') on the corporate network."
  ],
  "what_to_avoid": [
    "Do not assume only gaming credentials were stolen; keyloggers capture everything typed, including corporate VPN passwords and sensitive emails.",
    "Avoid dismissing the incident as 'just a game hack'; the endpoint is fully compromised and must be treated as a security breach."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}