The campaign, which has recorded over 19 million malware distribution attempts in a single year, demonstrates how cybercriminals are increasingly exploiting the digital native generation’s passion for gaming to execute large-scale data theft operations. This malware demonstrates advanced capabilities, extracting user data from Steam gaming platforms while simultaneously targeting messaging applications including Telegram, WhatsApp, and social media platforms such as TikTok, YouTube, Instagram, and Discord. A sophisticated malware campaign targeting Generation Z gamers has emerged, leveraging weaponized versions of popular games to infiltrate gaming communities and steal sensitive information. This self-preservation mechanism ensures the malware remains operational in genuine victim environments while avoiding detection by automated security systems and manual analysis attempts. Following its initial discovery, the Hexon stealer underwent a strategic rebrand to “Leet,” incorporating enhanced anti-analysis features that represent a significant evolution in malware design. The primary attack vector involves distributing malicious game installer files disguised as legitimate versions of popular titles including Grand Theft Auto, Minecraft, and Call of Duty. The threat landscape has evolved beyond simple phishing schemes to include sophisticated stealer malware that targets multiple platforms simultaneously. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The malware operators have strategically chosen these titles due to their massive online communities and the constant demand for modifications, cheats, and cracked versions among players. Upon detecting virtualization indicators, the malware immediately terminates its execution, effectively preventing security researchers from analyzing its behavior in controlled laboratory settings. Kaspersky analysts identified the Hexon stealer as a primary threat in November 2024, distributed through gaming forums, Discord channels, and file-sharing sites. The cybercriminals behind this campaign operate under a malware-as-a-service model, where technically skilled actors provide malware tools to less experienced criminals for a fee. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. The updated version implements a multi-layered sandbox bypass mechanism that begins with systematic verification of the infected device’s public IP address and comprehensive system specification analysis.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 14 Jul 2025 16:55:13 +0000