{
  "family": "habbo",
  "sample_count": 2,
  "category": "trojan",
  "description": "Trojan:Win32/Habbo (or HackTool:Win32/Habbo) is a highly specialized threat designed specifically to target users of 'Habbo Hotel', a massive online virtual community and social networking service. Its primary objective is credential theft (`T1056`) and the theft of virtual currency ('Habbo Coins') or rare virtual items, which hold real-world monetary value within illicit gray markets.<br><br><b>Understanding Habbo Trojans (Targeted Gaming Malware)</b><br>To an end-user (often teenagers or younger demographics), the infection usually stems from attempting to cheat the game or acquire free currency. For a security analyst, this malware highlights the risk of social engineering targeting younger demographics and the real-world financial implications of virtual economies. While primarily focused on a game, the compromised endpoint can easily be repurposed for a botnet.<br><br><b>Execution and Credential Theft Mechanics</b><br>Habbo trojans rely entirely on deceptive social engineering for distribution (`T1566`). They are heavily promoted on YouTube, gaming forums, and Discord servers as 'Coin Generators', 'Furni (Furniture) Duplicators', or 'Account Hackers'. When the victim executes the fake tool, it usually presents a deceptive GUI asking for their Habbo username and password to 'inject' the coins. Instead, it immediately transmits these credentials to the attacker (`T1041`). More advanced variants act as persistent keyloggers (`T1056.001`) or steal browser session cookies (`T1539`) to bypass two-factor authentication and hijack the account seamlessly.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the theft of the user's online identity and virtual assets, which can lead to significant distress and financial loss (if real money was spent). Host-based IoCs include the presence of executables with names like `HabboCoinGen.exe`, `CreditsHack.exe`, or `FurniDupe.exe`. EDR alerts may flag these tools for attempting to install global keyboard hooks (keylogging) or accessing browser profile directories to steal cookies. Network IoCs include the tool making outbound HTTP/SMTP connections to unknown servers immediately after the user enters their credentials.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1539",
    "T1056.001",
    "T1566"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging (Capturing credentials entered into the fake tool)",
      "tactic": "Collection"
    },
    {
      "id": "T1539",
      "name": "Steal Web Session Cookie (Bypassing authentication by stealing Habbo session tokens)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1566",
      "name": "Phishing (Social engineering via 'Coin Generator' lures)",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Immediately use a clean device to log into the Habbo account, change the password, and enable two-factor authentication (if available).",
    "Isolate the infected machine and delete the fake 'generator' or 'hacking' tool.",
    "Run a full system scan to ensure the fake tool did not drop secondary payloads, such as a persistent botnet agent or generic RAT.",
    "Educate the user (often a younger family member) about the dangers of downloading 'cheats' or 'hacks' for online games."
  ],
  "what_to_avoid": [
    "Do not enter credentials into any third-party application claiming to offer free virtual currency; these are almost exclusively scams or malware.",
    "Avoid dismissing the incident as 'just a game'; the compromised machine is on your network and could be used for lateral movement."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}