Trojan found in fake World of Warcraft client

Blizzard has issued a warning to its World of WarCraft players of a trojan masquerading as the game’s Curse client (used for downloading updates and launching the game(.

According to Blizzard:

-The trojan is built into a fake (but working) version of the Curse Client that is downloaded from a fake version of the Curse Website. This site was popping up in searches for “curse client” on major search engines, which is how people were lured into going there.

-At this point, it seems the easiest method to remove the trojan is to delete the fake Curse Client and run scans from an updated Malwarebytes. Should you still have issues, there is a more manual method that Ressie posted earlier in the thread.

-If you were compromised, follow the instructions here and we’ll do our best to set everything right (as we always do).

-For those of you interested in these MitM style attacks, this is the only confirmed case we’ve seen in several years outside of the “Configuring/HIMYM” trojan in early 2012 that hit a handful of accounts. These sort of outbreaks are annoying, but an Authenticator still protects your account 99% of the time. Stay safe!

While affecting WoW players in this instance, it’s a good lesson for those of us who may become a little complacent when searching for and downloading game clients – watch out for scams!

More gaming news

Cyber-attack takes down Steam, Origin services

Steam download stats for SA

Marvel games disappear from digital stores

Forum discussion

Join the conversation

  • Medibooze

    >Headline: ”…fake World of Warcraft client”

    There’s a difference between the WoW client and the Curse client. The former quite obviously being the game client, while the latter is a (independent) program used to download addons for several games like WoW, Starcraft etc.

    >Synopsis: ”…masquerading as the WoW client…”

    No. Masquerading as the Curse client.

    >Article: ”…as the game’s Curse client (used for downloading updates and launching the game(.”

    It’s not the ‘game’s client’ but Curse’s. And it’s used for downloading addons (and their updates- not the games’). I’ve not played in quite a while, and never noticed that you’re able to launch the (a) game from the Curse clien, but if so, it’s definitely not the default way of doing so.

  • Paul Cassells

    “While affecting WoW players in this instance…”

    I see what you did there

Trojan found in fake World of Warcraft client

Related posts