{
  "family": "wsgame",
  "sample_count": 15,
  "category": "infostealer",
  "description": "WSGame (classified as Trojan:Win32/WSGame and Trojan-GameThief.Win32.WSGame across Microsoft Defender, Kaspersky, and Trend Micro) is a dedicated gaming credential and asset theft trojan targeting popular MMORPG and online gaming platforms (such as World of Warcraft, Lineage, and Steam). Distributed through game cheat engines, bots, modified game clients, and phishing sites, WSGame monitors active window titles and injects DLL hooks into game processes to intercept login credentials, character session tokens, and one-time passwords. WSGame logs entered keystrokes via low-level keyboard hooks and captures network packets related to in-game trading, exfiltrating stolen user credentials to remote command-and-control servers to enable automated virtual asset theft.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/WSGame",
    "Trojan-GameThief.Win32.WSGame",
    "PWS:Win32/WSGame",
    "WSGame Stealer",
    "Win32/WSGame"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/WSGame?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "WSGame is an infostealer trojan designed specifically to steal credentials and account tokens from online gamers."
      }
    },
    {
      "@type": "Question",
      "name": "How does WSGame intercept gaming passwords?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It monitors active window titles for targeted game executables and uses DLL injection and keyboard hooks to record logins."
      }
    },
    {
      "@type": "Question",
      "name": "How is WSGame distributed to gamers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Via trojanized game cheat tools, botting utilities, pirated game addons, and deceptive gaming forums."
      }
    },
    {
      "@type": "Question",
      "name": "What games are commonly targeted by WSGame?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Popular MMORPGs including World of Warcraft, Lineage, Steam accounts, and popular multiplayer titles."
      }
    },
    {
      "@type": "Question",
      "name": "How should gamers secure their accounts against WSGame?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Avoid unofficial game cheats and cracks, enable mobile two-factor authentication (Steam Guard, Blizzard Authenticator), and run updated antivirus software."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1055",
    "T1555",
    "T1547.001",
    "T1041",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the active exfiltration of browsing telemetry and the downloading of further adware modules.",
    "Audit Windows Group Policies and the Registry to remove any forced extension installation policies created by the adware.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to locate and strip the deeply embedded registry hooks and watchdog services.",
    "Force a complete reset of all installed web browsers to factory defaults to eradicate the rogue extensions and restore the homepage."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's 'remove extension' button; Wsgame frequently uses GPOs and watchdog services to immediately reinstall itself.",
    "Avoid ignoring the infection; adware tracking data is highly detailed and may expose corporate activities or access to internal portals."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/WSGame",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/WSGame"
    },
    {
      "name": "Kaspersky Threat Intelligence - Trojan-GameThief Overview",
      "url": "https://threats.kaspersky.com/en/threat/Trojan-GameThief.Win32/"
    },
    {
      "name": "MITRE ATT&CK - Input Capture: Keylogging (T1056.001)",
      "url": "https://attack.mitre.org/techniques/T1056/001/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}