TikTok has made people do all sorts of wild things — eat frozen honey, work on their choreography and even fall for malicious malvertising campaigns.
The latest TikTok attacks are getting served to gamers on the platform disguised as “free” or “hacked” versions of games like Among Us, free Steam accounts and more, according to a new report from Malwarebytes Labs.
“What we sometimes see on TikTok is gaming-themed accounts making many of the same promises you see on other platforms,” the report said. “Free games, free items, free stuff. Everything is definitely free with no strings attached. Would RandomAccountGuy3856 lie to you?”
One example offered a free “Among Us Always Impostor Hack,” which promised to let the user play as an impostor on command.
“Also, you can choose between Normal Impostor Mode or Legend Impostor Mode, that will also change your kill countdown to 0 seconds, and you sabotage cooldowns to 0, if you want to annoy your friends,” the attackers promised.
Instead, the link served up malicious ads.
TikTok Helps Target Young Gamer
The report acknowledges these kinds of attacks are hardly anything new. But presented with a video of a person making the pitch makes them feel more intimate and targeted. Considering games like Among Us are largely played by tweens and teenagers, the emerging TikTok landscape could be a potent tool for threat actors to launch offensives against kids, researchers pointed out.
“These are tried-and-tested techniques on other platforms, with an added sheen of believability provided by the TikTok videos which look and sound convincing to the untrained eye — which is exactly what scammers are banking on,” Malwarebytes Labs’ Chris Boyd told Threatpost.
“There’s just something a bit more personal about having what looks like real people telling you genuine-sounding things in a short video clip,” the Malwarebytes team commented. “It all feels very informal and casual, and that’s exactly the kind of ambience a scammer would look to hit you with alongside their dubious websites and offers.”
Among Us, Steam Cyberattacks Continue
Among Us and Steam have both been targeted in past attacks. In doldrums of the pandemic lockdown in Oct. 2020, Among Us saw a meteoric rise in players and along with it a crush of hackers looking for a quick payday with a side of attention. The challenges of scaling security to meet a random moment of viral demand carves out new opportunities for malicious actors.
Steam has likewise had trouble. In August, the platform’s Spart2Pay API was exploited to add limitless funds to gamer wallets. In September, a trojan called BloodyStealer was being passed around underground forums and used to steal player accounts on Steam, Epic Games Store and EA Origin.
There appears to be no signs of cyberattacks against games and gamers slowing. Akamai reported in June that web-application attacks on the game industry shot up 340 percent in 2020.
“Games are expensive. Even without the costs of downloadable content (DLC), you also have things like season passes, in-game currency frequently purchased with real money, lootboxes,and more,” according to the report. “Where it tends to go wrong is with the promise of everything being free. If it’s too good to be true…and so on.”
For younger users, it’s up to parents to provide junior gamers with enough security awareness to avoid these types of scams, according to Boyd.
“As before, adults helping the child out with some gentle security assistance is the best way to go,” he told Threatpost. “Update Windows, ensure security tools are up and running, and consider using browser-based tools which block known rogue ad domains. The less intrusive the solutions to this problem are, the more likely that younger gamers will accept the helping hand.”
Check out our free upcoming live and on-demand online town halls – unique, dynamic discussions with cybersecurity experts and the Threatpost community.
