PSA: Steam Scam Involving Fake Razer Comms Download Discovered

[Steven Bogos]

PSA: Steam Scam Involving Fake Razer Comms Download Discovered

Malwarebytes intelligence analyst Chris Boyd has discovered a new Steam scam that unknowingly installs spyware on users PCs.

These days, Steam scammers are getting more and more clever, and using more and more sophisticated methods and programs, and now, Malwarebytes intelligence analyst Chris Boyd has discovered one of the most sophisticated yet. Instead of the usual fake Steam community pages [https://blog.malwarebytes.org/fraud-scam/2014/07/steam-account-phishers-caught-squatting/], this time phishers are using a fake Razer Comms download page as bait. For your information, Razer Comms is Razer's proprietary VOIP protocol, in the same vein as Mumble or Ventrilo.

Anyway, the fake page looks something like the one to the right, and is an exact copy of the official Razer Comms page. The Google Play link even links to the official Google Play store for the app, but the Download for Windows link simply rewards the user with spyware.

The bogus file it downloads to users PCs is an .scr file - a format that is very common in fake in-game trading scams. Boyd says that Malwarebytes should be able to detect and destroy the program, but is currently not "firing on all cylinders" and may occasionally let it slip by for whatever reason. For this reason, users should be especially cautious.

Once installed, the .scr file essentially sits on your computer as a keylogger, and will shoot off your passwords to phishers somewhere in the world.

Boyd says his team has managed to peek into the program's code, and has discovered that it points to a Russian gaming portal with multiple threads on hacking related topics, and some advertisements for a program that steals Steam user accounts.

"The most attractive way in for scammers where Steam accounts are concerned is trading," warns Boyd. "In most cases that we see, the name of the game is luring the victim outside of the trade system window. If you're being sent links to "previews" of items in Steam chat by strangers who started messaging you ten minutes ago? You may be on your way to a bad day."

So there you have it folks. Stay safe, and make sure to always double check everything you download to your PC!

Permalink

 

[Strazdas]

I wonder who is getting all those scams. i keep hearing about them yet i never had anyone attempt to scam me.

Then im probably not the target audience. i would never download razer coms or any other proriatary chat service and sure as hell would never run a .scr file i didnt see built myself.

Also are these folks so incompetent to have links in the malware pointing to its origins? either that or malwarebytes found it another way and are lieing.

 

[Albino Boo]

I wonder who is getting all those scams. i keep hearing about them yet i never had anyone attempt to scam me.

Then im probably not the target audience. i would never download razer coms or any other proprietary chat service and sure as hell would never run a .scr file i didnt see built myself.

Also are these folks so incompetent to have links in the malware pointing to its origins? either that or malwarebytes found it another way and are lieing.

What they do is join some of the big steam groups and then use a program to make friend invites to the entire membership. Then a while later use another program to spam the link to the friends list. Once they have got control of someones hacked they then use that in more targeted manner. So if you are not a member of large steam groups you are unlikely to be targeted.

 

[caiman16]

I wonder who is getting all those scams. i keep hearing about them yet i never had anyone attempt to scam me.

Then im probably not the target audience. i would never download razer coms or any other proriatary chat service and sure as hell would never run a .scr file i didnt see built myself.

Also are these folks so incompetent to have links in the malware pointing to its origins? either that or malwarebytes found it another way and are lieing.

I got the message but used my antivirus to scan the file before, as I saw the .scr extension and knew it was something weird. The antivirus deleted the file before anything could happen.

 

[Rozalia1]

Gee no link to a guide on how we can get our own? News reporting standards on the escapist dropping I expected to learn how I could make some easy money.

There is always these sort of stories about. Never an issue for me but these sort of stuff is always something I need to warn my younger brother about... otherwise it just gives me work.

 

[Strazdas]

I wonder who is getting all those scams. i keep hearing about them yet i never had anyone attempt to scam me.

Then im probably not the target audience. i would never download razer coms or any other proprietary chat service and sure as hell would never run a .scr file i didnt see built myself.

Also are these folks so incompetent to have links in the malware pointing to its origins? either that or malwarebytes found it another way and are lieing.

What they do is join some of the big steam groups and then use a program to make friend invites to the entire membership. Then a while later use another program to spam the link to the friends list. Once they have got control of someones hacked they then use that in more targeted manner. So if you are not a member of large steam groups you are unlikely to be targeted.

Well i am in steam music group (197,109 Members) and still no invites. Im also in another large group that is 44,772 Members and still not being scammed

not sure how big other steam groups may be, maybe this is peanuts in comparison.

 

[Albino Boo]

What they do is join some of the big steam groups and then use a program to make friend invites to the entire membership. Then a while later use another program to spam the link to the friends list. Once they have got control of someones hacked they then use that in more targeted manner. So if you are not a member of large steam groups you are unlikely to be targeted.

Well i am in steam music group (197,109 Members) and still no invites. Im also in another large group that is 44,772 Members and still not being scammed

not sure how big other steam groups may be, maybe this is peanuts in comparison.[/quote]

I have been an admin on some the larger TF2 server groups and we used to get complaints regularly about the blind invite spam. Its tends be on groups with something worth stealing in the inventory. Some of the TF2 hats go for real money

 

[Matthew Lynch]

I just reject and block any random friend requests I get, a policy I took up after a bad experience in my first month of using steam.

 

[Veldel]

Considering how many people try to scam me on a daily basis in steam not suprised until this scamming happened I never had to block people or anything now it's just adding up to more and more people. Wish they would give up and stop trying to take my stuff.

 

[IamLEAM1983]

Kid from Yugoslavia: "I give you hats for game."
Me: "LOL, kthnxbai." *closes window*

How do these things work, anyway? Some guys trawl Steam looking for super-users with a library in the hundreds or so, and then they try their luck with the Pity card? I never was accosted by anyone who had anything I'd even remotely consider as a decent trading offer. I mostly sell my Team Fortress 2 cruft on the Marketplace and do the same with my trading cards.

On the other hand, I *have* met completely bonkers idiots who thought that my being a dedicated PC gamer meant I'd have cash to spare on extra copies for games I already own. If you knock them off of their charity pedestal and mention places like Desura or Green Man Gaming, the insults typically start to come out...

 

[Vigormortis]

So...

Yet another, likely far-reaching, scam that could easily be avoided by some basic common sense and safe surfing/browsing/gaming practices.

Good to know I've nothing to worry about, then. Sad, though, that this will almost assuredly mean my Steam Friends 'Blocked' list will grow by leaps and bounds.

 

[NuclearKangaroo]

russians... every single time

im not even surprised at this point, probably some of the hundreds of lvl 0 accounts that ive blocked wouldve tried this on me, again, if i wasnt blocking them all on sight

 

[RicoADF]

If only these people had better things to do, if they spent their time productivity perhaps they'd achieve something of worth.

This is why I have steam set to require email authentication and don't go to any links unless it's a friend I'm talking to at the time/have confirmed with them its legit.