World of Warcraft Trojan spreads from Asia

Powered by SC Magazine

Password stealing malware hits US and Turkey and accounts for almost 13 per cent of malware activity detected in a recent survey.

Password-stealing programs affecting online games such as World of Warcraft accounted for almost 13 per cent of malware activity detected in a recent survey.

While China and Taiwan are most seriously affected, infections appear to be spreading out of the region, initially into Turkey, according to a report from security firm Fortinet.

"While the main activity remains in China and Taiwan, activity has risen in Turkey," said Fortinet security researcher Derek Manky.

China suffered 36.5 per cent of all attacks from online game Trojans in June, followed by Taiwan with 31.1 per cent, Turkey with 15.4 per cent and the US with 7.4 per cent.

Fortinet recorded a particularly sharp rise in attacks by the 'W32/OnlineGames!tr' malware, which steals passwords and other account data from online games including World of Warcraft and sends them to a remote server.

More than 7.5 per cent of all recorded attack attempts were generated by this Trojan, which was first identified in April 2007.

The malware also attempts to grab log-in details from YouXiChaYuan and Perfect World, two online games popular in China and some other Asian countries.

It is not clear from Fortinet's description whether 'W32/OnlineGames!tr' is limited to specific language versions of Windows or the World of Warcraft client. The company does not explain how PCs become infected.

Once the malware is executed, it adds an instruction to run itself on Windows startup to the Windows registry and also injects code into the explorer.exe process, as well as attempting to steal the game passwords.

"With the online gaming market thriving with consumers, malicious activity will very likely continue for some time in this emerging sector as it forms a viable target," said Manky.

Fortinet gathers statistics by monitoring malware activity reported by its security hardware and software installed at client sites.

Copyright ©

Top Stories
Microsoft confirms Australian Azure launch
Available from next week.
NBN Co names first 140 FTTN sites
National trial extended.
Cloud, big data propel bank CISOs into the boardroom
And this time, they are welcome.
Sign up to receive iTnews email bulletins
Latest Comments
In which area is your IT shop hiring the most staff?

   |   View results
IT security and risk
Sourcing and strategy
IT infrastructure (servers, storage, networking)
End user computing (desktops, mobiles, apps)
Software development

Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results