Just shortly after, the message outing the file as a trojan is deleted. The user “Genius”, who we suspect is the malware author, asks for proof. Unfortunately, from the conversation it is apparent that the user tried to start the private server and got unwittingly infected as a result.Īnother user reacts to the victim’s post, pointing out that the file is a trojan. The file executes and a window pops up for a split second, so quickly that the victim doesn’t even realize something happened. As we know, the file is in reality password stealer malware, which does work. In a channel within the Discord server called “chat”, a user asks what to do, because the private server doesn’t work. In the Discord server we analyzed, a user with the username “Genius” notifies everyone in the channel to download the “private server”. This leads us to believe that the password stealer malware is being distributed on more than one Discord channel. In another video on the TikTok account, a Discord server (not the one we found) is shown. People on the server also offer Fortnite accounts for sale, which, allegedly, contain skin items that the buyer can use or sell elsewhere. The Discord server is called “Storm Community”, and has close to 300 users and is growing. Screenshot of one of the tutorial videos describing in detail how people can join the Discord server where they are encouraged to download the malicious file. TikTok account promoting the Discord server hosting the malicious file One of the videos, which is an older video, is more thorough, for example, it contains instructions on how to disable antivirus protection on the victim’s PC, to guarantee the malware can run. We have seen two examples of tutorial videos on the account describing how to join the Discord server and download the malware, in detail. The TikTok account hosting the tutorial videos is called “shtorm_genius”, as can be seen in the screenshot below. Since the beginning of this year, Avast has protected more than 2,000 customers from this password stealer. The campaign is in Russian, mostly targeting Russian gamers. The malicious campaign takes advantage of young gamers looking for private matches to customize their Fortnite character’s appearance to reflect their personality or mood.
0 kommentar(er)
