{
  "family": "gamehuck",
  "sample_count": 8,
  "category": "trojan",
  "description": "PWS:Win32/Gamehuck is a highly specialized Password Stealer (PWS) trojan designed specifically to target, harvest, and exfiltrate credentials and valuable digital assets from online gaming platforms (such as Steam, Battle.net, Origin, and various MMOs). The primary motivation behind Gamehuck is financial; stolen accounts with rare in-game items or linked credit cards are rapidly sold on underground forums.<br><br><b>Understanding Gamehuck</b><br>To an end-user, the infection often begins when they download a 'cheat', 'aimbot', or 'currency generator' for a popular video game. The malware operates silently in the background, specifically monitoring for the launch of targeted gaming clients. For security analysts, while Gamehuck might seem like a consumer-focused threat, its presence on a corporate endpoint indicates a severe violation of acceptable use policies and proves that the user is actively bypassing security controls to execute untrusted binaries.<br><br><b>Execution and Credential Harvesting Mechanics</b><br>Gamehuck is almost exclusively distributed via deceptive social engineering on gaming forums, Discord servers, and YouTube videos advertising game hacks (`T1204.002`). Upon execution, the malware establishes persistence via the `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` registry key (`T1547.001`). Its core functionality revolves around credential access (`T1555`). It scans the file system for specific configuration files (like Steam's `ssfn` authorization files) and uses keylogging (`T1056.001`) when the user types their password into the gaming client. Advanced variants also attempt to steal session cookies from web browsers to bypass Multi-Factor Authentication (MFA) on the gaming platforms (`T1539`). The harvested data is then encrypted and exfiltrated to a C2 server or dropped into a Telegram channel (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the loss of personal gaming accounts and potential financial loss, though on a corporate network, it represents a compromised endpoint. IoCs include EDR alerts for keylogging activity (API hooks on `SetWindowsHookEx`) originating from a recently downloaded binary. Network analysts might observe unauthorized FTP or HTTP POST requests containing encrypted archives sent to unusual IP addresses.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1056.001",
    "T1539",
    "T1204.002",
    "T1555"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1555",
      "name": "Credentials from Password Stores (Targeting gaming client configs)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging (Capturing game logins)",
      "tactic": "Collection"
    },
    {
      "id": "T1539",
      "name": "Steal Web Session Cookie (Bypassing MFA)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File (Disguised as game cheats)",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint to prevent further exfiltration of credentials or the download of secondary payloads.",
    "Force a password reset for all corporate accounts used by the individual, as the keylogger may have captured more than just gaming credentials.",
    "Use EDR to locate and terminate the Gamehuck process, and remove the associated Registry Run keys.",
    "Investigate how the user was able to download and execute an untrusted, unapproved binary (the 'game hack') on the corporate network."
  ],
  "what_to_avoid": [
    "Do not assume only gaming credentials were stolen; keyloggers capture everything typed, including corporate VPN passwords and sensitive emails.",
    "Avoid dismissing the incident as 'just a game hack'; the endpoint is fully compromised and must be treated as a security breach."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}