As the gaming world continues to evolve, so do the threats that come with it. Hamster Kombat, a highly popular clicker mobile game, has become the latest target for cybercriminals who are exploiting its massive user base. With over 250 million players, the game has attracted malicious actors who are distributing fake Android and Windows software to install spyware and steal information.
The Rise of Hamster Kombat
Hamster Kombat is a mobile game for Android where players earn fictional currency by completing simple tasks, primarily by tapping the screen. Launched in March 2024, the game quickly gained traction due to the promise of earning a new TON-based crypto token, which is scheduled to be introduced later this year.
To play Hamster Kombat, users must join its channel on Telegram, scan a QR code provided by a bot, and then launch a web app on their Android devices. Since its launch, the game has seen exponential growth, amassing over 250 million players and 53 million users on its Telegram channel.
Cybercriminals Targeting Hamster Kombat Players
The massive popularity of Hamster Kombat has not gone unnoticed by cybercriminals. Threat actors are taking advantage of the game's success by creating fake apps and websites to distribute malware.
Join our WhatsApp Channel 👈🏿
One significant risk lies in Telegram, where various Hamster-branded channels distribute Android malware to users searching for the official channel. ESET, a leading cybersecurity firm, has found multiple cases where threat actors use the Hamster Kombat game as bait, extending their attacks to other platforms beyond Android, including Windows.
The Malware Attacks
ESET identified a Telegram channel named 'HAMSTER EASY' that distributes the Ratel Android spyware as an APK file ('Hamster.apk'). This spyware does not contain any legitimate functionality and primarily aims to subscribe victims to premium services, from which the malware operators profit. Ratel can intercept SMS and device notifications, hiding notifications from 200 apps to prevent the victim from realizing they have subscribed to various premium services.
Another malicious campaign uses fake websites like 'hamsterkombat-ua.pro' and 'hamsterkombat-win.pro' that claim to offer the game but instead redirect visitors to advertisements, generating revenue for the attackers. Additionally, Hamster Kombat-branded scams target Windows users, with Lumma Stealer being distributed through malicious GitHub repositories claiming to offer farming bots for the cryptocurrency game.
ESET's report highlighted that these GitHub repositories either had the malware available directly in the release files or contained links to download it from external file-sharing services. The Lumma Stealer cryptors were found in three different versions: C++ applications, Go applications, and Python applications. Of the three, the Python version was the most sophisticated, featuring a graphical installer to deceive victims until the malware installation process was complete.
The Real Dangers and Precautions
For those interested in the Hamster Kombat project, it is crucial to obtain the game from its official Telegram channel or the project's website. However, it should be noted that even the genuine game itself has not undergone thorough security scrutiny, as it is not available on Google Play or the App Store. The project's whitepaper has yet to be published, and the token launch promises remain unfulfilled.
Moreover, the clone app on Google Play has received numerous reports claiming it scams users by asking for withdrawal fees and never performing the money withdrawal. It is advisable to treat any Hamster Kombat copycat apps distributed via any platform or method with extreme caution, as they are likely to be scams or contain malware.
Conclusion
The rise of Hamster Kombat has brought with it significant risks, as cybercriminals exploit the game's popularity to distribute malware and steal information. Players must exercise caution and only download the game from official sources. With the game's security yet to be thoroughly vetted, users should remain vigilant and skeptical of any suspicious activities surrounding the game.
For those interested in cryptocurrency gaming projects, Decrypt.co has compiled a list of legitimate projects that launched tokens in 2024 and have a functional system in place. Exploring these alternatives might be a safer bet for those looking to invest their time and resources in this emerging market.
Engage with Us
What measures do you think should be implemented to protect gamers from such malware attacks? Share your thoughts and experiences in the comments below!
Related Articles
_20240127_233647_0000.png)
_20240512_154301_0000.png)
0 Comments