Cybercriminal Campaign Spreads Infostealers, Highlighting Risks to Web3 Gaming

Insikt Group identified an extensive Russian-language cybercriminal campaign leveraging fraudulent Web3 gaming projects to deliver multiple variants of information stealer (“infostealer”) malware to both macOS and Windows devices. Web3 gaming refers to online games built on blockchain technology, which can result in financial gain for players who earn various cryptocurrencies. These fraudulent Web3 projects mimic legitimate projects with slight alterations in project names and branding. This fraudulent branding also includes multiple social media accounts that impersonate legitimate projects, which may provide an appearance of authenticity.

The targeted nature of this campaign suggests that threat actors may perceive Web3 gamers as having a more acute vulnerability to social engineering, due to an assumed trade-off in cyber hygiene — meaning that Web3 gamers may have fewer protections in place against cybercrime — in the pursuit of profit. The threat actors behind the campaign are creating the infrastructure necessary to enable redundancy and continuity, and the campaign’s agile nature implies resilience, indicating that it might be relatively straightforward for the threat actors to exit or rebrand once identified. We observed that the version of AMOS distributed in this campaign can infect both Intel-based and ARM-based (Apple M1) Macs, meaning that victims using either chipset may be vulnerable to the infostealer. Given the audience of Web3 gaming projects, it is almost certain that the threat actors are primarily targeting victims with cryptocurrency wallets. As wallet compromise continues to be the biggest threat in both Web3 and cryptocurrency security, measured by total cost, we assess that wallet compromise is likely the end goal of this campaign; however, the harvested credentials could be used for an array of unauthorized account accesses.

The campaign’s tactics, techniques, and procedures (TTPs) enable continued efficacy against mitigations based solely on endpoint detection and response (EDR) or antivirus (AV) products; targeted individuals and organizations must respond to the campaign’s cross-platform threat with a comprehensive mitigation strategy. Russian-language artifacts in the HTML code of these projects suggest the threat actors are likely Russian speakers. While we cannot make a determination of their exact location, the presence of such artifacts suggests that the threat actors could be located in Russia or a nation within the Commonwealth of Independent States (CIS).

Continuous monitoring of this campaign may not be feasible, meaning that individuals and organizations must mitigate against the broader attack vector itself. Since the campaign spreads via “trap phishing” software downloads, comprehensive awareness and user education campaigns are vital to discourage potential victims from downloading software from unverified and unofficial sources. Further recommendations are provided in the Mitigations section of this report.

Organizations operating in Web3 gaming or adjacent industries — such as the broader gaming industry or cryptocurrency exchanges, among others — risk their projects being impersonated as part of this campaign, which may lead to significant brand impairment if not remediated. While it is difficult to determine the financial loss from brand impairment, affected Web3 projects risk damaging their reputation with their entire user base and the broader Web3 gaming industry if a campaign like this is not addressed. Given the agile nature of this campaign, we assess that these threat actors will likely continue to target Web3 gaming projects with infostealers.

Web of Deceit: The Rise of Imitation Web3 Gaming Scams and Malware Infections

The campaign involves creating imitation Web3 gaming projects with slight name and branding modifications to appear legitimate, along with fake social media accounts to bolster their authenticity. The main webpages of these projects offer downloads that, once installed, infect devices with various types of "infostealer" malware such as Atomic macOS Stealer (AMOS), Stealc, Rhadamanthys, or RisePro, depending on the operating system.

The campaign targets Web3 gamers, exploiting their potential lack of cyber hygiene in the pursuit of profits. It represents a significant cross-platform threat, utilizing a variety of malware to compromise users' systems. The threat actors have prepared a resilient infrastructure, allowing them to quickly adapt by rebranding or shifting focus upon detection. The report highlights the necessity of continuous vigilance and recommends that individuals and organizations adopt comprehensive mitigation strategies against these sophisticated phishing tactics.

Specific findings reveal that the malware versions, including AMOS, can infect both Intel and Apple M1 Macs, indicating a broad vulnerability among users. The primary goal appears to be the theft of cryptocurrency wallets, posing a significant risk to financial security. Despite potential mitigations like endpoint detection and antivirus software, the campaign's techniques remain effective, suggesting the need for broader defense measures. Artifacts within the HTML code hint at the Russian origin of the threat actors, though their exact location remains uncertain. The report underscores the critical need for awareness and education to prevent downloads from unverified sources, highlighting the risk of brand damage to legitimate Web3 gaming projects if such threats are not adequately addressed.

To read the entire analysis, click here to download the report as a PDF.

Note: This report summary was first published on April 11, 2024 and has been updated on October 29, 2024. The original analysis and findings remain unchanged.