{
  "family": "gametool",
  "sample_count": 17,
  "category": "trojan",
  "description": "GameTool (classified in endpoint detection telemetry under designations including Trojan:Win32/GameTool, Spyware:Win32/GameTool, and HackTool:Win32/GameTool) is a deceptive trojan and info-stealer distributed disguised as video game enhancement software, aimbots, wallhacks, and cheat loaders for popular multiplayer titles. Once executed by unsuspecting gamers, GameTool requests elevated administrative permissions under the guise of injecting into game memory. Instead, it deploys background keyloggers and token grabbers, targeting gaming platform credentials (such as Steam, Discord tokens, Epic Games, Riot Games), web browser saved passwords (Chrome, Edge, Firefox), and cryptocurrency wallet extensions. GameTool establishes persistence via registry Run entries (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run), exfiltrating harvested credentials and session tokens to attacker Discord webhooks or Telegram bots over HTTPS.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/GameTool",
    "Spyware:Win32/GameTool",
    "HackTool:Win32/GameTool",
    "Win32/GameTool",
    "GameTool Cheat Stealer"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/GameTool?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "GameTool is a deceptive trojan disguised as a game cheat utility that harvests Discord tokens, gaming logins, and browser passwords."
      }
    },
    {
      "@type": "Question",
      "name": "How does GameTool steal Discord and gaming accounts?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It scans Discord AppData storage files for authentication tokens and parses browser SQLite databases using DPAPI decryption."
      }
    },
    {
      "@type": "Question",
      "name": "How is GameTool distributed to victims?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is distributed through gaming forums, YouTube tutorial video descriptions, and Discord gaming communities as free cheat software."
      }
    },
    {
      "@type": "Question",
      "name": "Where does GameTool send stolen credentials?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It packages credentials into JSON strings and transmits them to attacker-controlled Discord webhooks or Telegram bot channels."
      }
    },
    {
      "@type": "Question",
      "name": "What remediation steps should be taken if infected by GameTool?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Immediately reset passwords for gaming and email accounts from another device, enable two-factor authentication, and run a full malware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1555.003",
    "T1056.001",
    "T1547.001",
    "T1082",
    "T1041"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2019,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Video Game Cheats and Trainers",
    "YouTube Description Links and Gaming Discord Servers",
    "Torrent and P2P File Sharing Downloads"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Discord Authentication Token Extraction",
    "Browser Password & Cookie Decryption (DPAPI)",
    "Cryptocurrency Wallet Directory Harvesting",
    "Keystroke Logging & System Telemetry Collection",
    "Exfiltration via Discord Webhooks & Telegram APIs"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      ".NET Executable"
    ],
    "network_signatures": [
      "HTTPS POST requests to discord.com/api/webhooks/ with embedded credential payloads",
      "HTTPS requests to api.telegram.org transmitting system summaries"
    ],
    "evasion_techniques": [
      "Using legitimate Discord and Telegram API channels to evade firewall blocking",
      "Packing with ConfuserEx or custom .NET protectors to hinder decompilation"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "e5f60718293a4b5c6d7e8f9a0b1c2d3e4f5a6b7c",
      "f60718293a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\GameToolHelper"
    ],
    "file_paths": [
      "%AppData%\\GameTool\\loader.exe",
      "%LocalAppData%\\Temp\\tokens.txt"
    ]
  },
  "defensive_measures": [
    "Educate users on the risks of executing unverified game cheat software and trainers",
    "Deploy endpoint application whitelisting and block execution of unsigned binaries in AppData",
    "Monitor network firewalls for unusual outbound HTTPS POST traffic to Discord webhooks from non-browser processes"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/GameTool",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/GameTool"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.GameTool",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Trojan:Win32/GameTool.A",
      "Spyware:Win32/GameTool.B"
    ]
  },
  "attack_stage": [
    "initial_access",
    "execution",
    "credential_access",
    "collection",
    "exfiltration"
  ],
  "ecosystem": [
    "windows_pe",
    "dotnet"
  ],
  "is_emerging": false,
  "motivation": "Account Hijacking & Credential Theft",
  "sample_hashes": []
}