📝 usncan Note: Microsoft Windows Warning—Stop Playing These Free PC Games
Disclaimer: This content has been prepared based on currently trending topics to increase your awareness.
These games are dangerous.
Getty Images
Windows users have already been warned that saving large files on their PCs might kill SSD drives and corrupt their data. Now there’s a new warning — installing free games could have even more disastrous consequences as hackers strike again.
We’re talking pirated games and the discovery by a Trellix researcher that a complex web of redirects when downloading a free copy of a game actually installs dangerous malware that will hijack your PC, disable security software and install vicious malware.
The researcher focused on Dodi Repacks, which “distributes pirated games” and is listed as safe/trusted on various piracy forums.” When clicking to download “the most recent game that was uploaded to the site,” multiple redirects eventually lead to a ZIP archive.
The archive included a .dll that was “over half a gigabyte in size — a common tactic by threat actors to prevent users from uploading their files to online scanners and sandboxes, since most of them have a size limit.”
But the file included a call “that definitely should not be there,” and which turned out to be a malicious function running scripts on the PC to install the aptly named HijackLoader malware. This also bypasses common antivirus software as required.
“Keep in mind, all of this occurred with the adblocker uBlock Origin installed,” Trellix says, “so the often-parroted claim on piracy forums that ‘as long as you have an adblocker installed, you’ll be safe when downloading pirated software’ is patently false.”
Security software bypasses.
Trellix
Per CyberPress, if you take the risk with these pirated downloads, “HijackLoader utilizes sophisticated anti-analysis and anti-debug behaviors:
- Checks for virtual machines via hypervisor and vendor ID inspections.
- RAM and processor counts to evade sandboxes.
- Verification of system artifacts (e.g., usernames, computer names).”
If the malware green-lights itself after these checks, “the loader achieves persistence by manipulating environment variables, copying components to %APPDATA%, and executing the payload with custom mutex logic.”
HijackLoader’s focus is to load malware onto your PC, evading Microsoft and other security that’s running, delivering and installing malware without you being warned. Once that’s done, everything on the machine is at risk.
Zscaler says that “the loader is not only capable of delivering second-stage payloads, but also offers a variety of modules to expand the malware’s capabilities, and that “the loader is being leveraged to drop numerous malware families, including Danabot, SystemBC, and RedLine Stealer, amplifying its potential threat.”
Trellix says that “in the majority of cases lately, the final payload being deployed by HijackLoader has been LummaC2. However, the following families have been seen using HijackLoader in the past:
- Tofsee
- Remcos
- Vidar
- xWorm
- Redline Stealer
- Danabot
- Rhadamanthys
- StealC
- XMRig
- Amadey”
“Cybercriminals have weaponized the demand for pirated games,” CyberPress says.
You have been warned.
