Researchers at Hunt.io identified messages on the game’s forum directing players to phishing websites under the pretext of discussing security for in-game assets tied to their accounts. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Albion Online, a multiplayer online role-playing game with a player-driven economy, has become a lucrative target due to third-party markets where in-game assets are exchanged for real money. A key component of the attack is a Windows shortcut (LNK) file named “Report-Albion-Online.lnk” which executes PowerShell with an Execution Policy Bypass to run malicious scripts. This Python script contains two encoded portions that, when decoded, reveal connections to command and control servers at 104.245.240.19:443 and 212.87.222.84:443, identified as Stealc stealer and Pyramid C2 infrastructure respectively. With recent attack disclosures like Browser Syncjacking and extension infostealers, browser extensions have become a primary security concern at many organizations. Cybersecurity researchers have uncovered a sophisticated campaign targeting the Albion Online gaming community through impersonation of the Electronic Frontier Foundation (EFF). Tushar is a Cyber security content editor with a passion for creating captivating and informative content. The operation, discovered in early March 2025, leverages decoy documents designed to appear as official EFF communications while deploying malware in the background. The attackers employed an exposed open directory containing a mix of PDFs, ZIP archives, and PowerShell scripts, revealing their operational infrastructure. Upon execution, the PowerShell script retrieves malicious components and drops them into the victim’s system. This campaign shows that how threat actors combine legitimate organizations’ reputations with technical sophistication to target specific communities. Users are advised to verify the authenticity of communications and exercise caution with unsolicited messages, especially those requesting immediate action.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 06 Mar 2025 17:45:23 +0000