{
  "family": "game",
  "sample_count": 144,
  "category": "trojan",
  "description": "Trojan:Win32/Game is a broad, generic classification for a vast array of trojans, stealers, and cryptominers that are intentionally disguised and distributed as modifications, cheats, 'trainers', or pirated copies of popular PC games.<br><br><b>What is Game Malware?</b><br>For the consumer, executing a fake game mod often results in a compromised gaming account, stolen virtual assets, or a drastically slowed computer (due to hidden cryptomining). For security analysts, this represents a highly effective social engineering vector targeting a demographic (gamers) known for frequently disabling Antivirus software to run unauthorized, memory-altering executables.<br><br><b>Infection Vectors & Threat Hunting</b><br>Game trojans are distributed via fake YouTube tutorials, malicious Discord servers, and compromised gaming forums. Attackers specifically target popular titles (like GTA V, Minecraft, or Roblox). Because legitimate game cheats inherently require behavior that mimics malware (e.g., DLL injection, memory reading/writing, hooking the DirectX API), gamers are conditioned to ignore AV warnings. Upon execution, the trojanized mod often drops a secondary payload—frequently RedLine Stealer, Phoenix Keylogger, or XMRig—into the <code>%AppData%</code> directory.<br><br><b>Forensic Analysis & Impact</b><br>The impact ranges from the theft of gaming credentials and Discord tokens to full system compromise. Incident responders should look for anomalous outbound network connections originating from the game's executable or newly dropped binaries in the user profile. EDR tools will flag the payload for 'Suspicious Process Injection', but analysts must differentiate between the legitimate game cheat attempting to hook memory and the malicious secondary payload attempting to steal data.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1555",
    "T1204.002",
    "T1055.001",
    "T1496",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1555",
      "name": "Credentials from Password Stores",
      "tactic": "Credential Access"
    },
    {
      "id": "T1496",
      "name": "Resource Hijacking",
      "tactic": "Impact"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint; users executing fake game mods often intentionally disable AV, meaning the machine is highly vulnerable to secondary payloads.",
    "Force a global password reset for all user accounts, specifically targeting gaming platforms (Steam, Epic), Discord, and web browsers.",
    "Perform a comprehensive EDR sweep of the endpoint to locate the secondary information stealers or cryptominers dropped by the fake mod.",
    "Enforce strict application whitelisting and local administrator restrictions to prevent users from executing unverified gaming tools on corporate assets."
  ],
  "what_to_avoid": [
    "Do not assume the endpoint is safe just because the game mod was deleted; the secondary payloads (like RedLine Stealer) are the primary threat.",
    "Avoid ignoring the policy violation; users executing game cheats on corporate networks present a massive insider risk."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}