{
  "family": "mumawow",
  "sample_count": 1,
  "category": "advanced_threat",
  "description": "<h3>Executive Summary</h3>\nMumawow (Muma) is a specialized Information Stealer (Info-Stealer) specifically designed to target players of massively multiplayer online role-playing games (MMORPGs), particularly World of Warcraft (WoW). Its primary objective is the theft of gaming account credentials (usernames, passwords, and authenticator codes) to facilitate the theft of in-game virtual currency, high-value items, and the accounts themselves, which are then sold on secondary black markets.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMumawow is typically distributed via highly targeted phishing campaigns directed at the gaming community. This includes malicious links posted on gaming forums, deceptive in-game messages promising \"free gold\" or rare items, or bundled within unverified game add-ons and UI modifications downloaded from untrustworthy sites.\n\nUpon execution, it performs a highly targeted data harvesting operation:\n<ul>\n<li><strong>Process Monitoring and Keylogging:</strong> The malware continuously monitors the system's running processes, waiting for the target game executable (e.g., `wow.exe`) to launch. Once detected, it activates a specialized keylogger designed to capture the login sequence.</li>\n<li><strong>Authenticator Bypassing:</strong> Advanced variants of Mumawow may attempt to intercept or manipulate the entry of two-factor authentication (2FA) codes, often by rapidly forwarding the captured code to a remote attacker who attempts to log in simultaneously.</li>\n<li><strong>Data Exfiltration:</strong> The stolen credentials and account details are exfiltrated via HTTP POST requests to an attacker-controlled server.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile a Mumawow infection primarily targets personal gaming accounts rather than corporate financial data, it still represents a significant security breach. Users frequently reuse passwords across multiple services; a compromised gaming password could quickly lead to the compromise of the user's primary email or banking accounts.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Global Credential Reset:</strong> The absolute highest priority is a complete password reset for the affected gaming account, as well as ANY other service (email, banking) that shares the same or a similar password. This must be done from a *different, clean device*.</li>\n<li><strong>Account Recovery:</strong> Contact the game publisher's customer support immediately to initiate account recovery procedures and attempt to reverse any unauthorized in-game transactions.</li>\n<li><strong>Endpoint Eradication:</strong> Run a full system scan using a reputable enterprise antivirus solution to remove the Mumawow executable and any associated keylogging DLLs.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "PWS.Mumawow",
    "TrojanSpy.WoWStealer",
    "Win32/Muma"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1555.003",
    "T1056.001",
    "T1048"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T06:50:10Z",
  "type": "Information Stealer / Game Password Stealer",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}