World of Warcraft Trojan spreads from Asia

Password stealing malware hits US and Turkey

Simon Burns in Taipei, vnunet.com 02 Jul 2008

Password-stealing programs affecting online games such as World of Warcraft accounted for almost 13 per cent of malware activity detected in a recent survey.

While China and Taiwan are most seriously affected, infections appear to be spreading out of the region, initially into Turkey, according to a report from security firm Fortinet.

"While the main activity remains in China and Taiwan, activity has risen in Turkey," said Fortinet security researcher Derek Manky.

China suffered 36.5 per cent of all attacks from online game Trojans in June, followed by Taiwan with 31.1 per cent, Turkey with 15.4 per cent and the US with 7.4 per cent.

Fortinet recorded a particularly sharp rise in attacks by the 'W32/OnlineGames!tr' malware, which steals passwords and other account data from online games including World of Warcraft and sends them to a remote server.

More than 7.5 per cent of all recorded attack attempts were generated by this Trojan, which was first identified in April 2007.

The malware also attempts to grab log-in details from YouXiChaYuan and Perfect World, two online games popular in China and some other Asian countries.

It is not clear from Fortinet's description whether 'W32/OnlineGames!tr' is limited to specific language versions of Windows or the World of Warcraft client. The company does not explain how PCs become infected.

Once the malware is executed, it adds an instruction to run itself on Windows startup to the Windows registry and also injects code into the explorer.exe process, as well as attempting to steal the game passwords.

"With the online gaming market thriving with consumers, malicious activity will very likely continue for some time in this emerging sector as it forms a viable target," said Manky.

Fortinet gathers statistics by monitoring malware activity reported by its security hardware and software installed at client sites.

See also: