Loading story…
ESET researchers uncovered Joao, a malware threat targeting gamers through trojanized installers for Aeria-published MMORPGs distributed on unofficial download sites. The campaign was observed using a malicious Grand Fantasia installer hosted on gf.ignitgames[.]to, where the game package had been altered to load a malicious DLL, mskdbe.dll, during installation.
Joao was described as a modular downloader that first profiled infected systems and then fetched additional payloads based on server-side decisions. Observed modules gave attackers backdoor, spying, and DDoS capabilities, and detections were reported worldwide. ESET said it blocked the malicious site and notified Aeria Games, while urging users to download games only from official sources and rely on security software to detect and remove the threat.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
ESET said it blocked the website serving the Joao malware and informed Aeria Games about the malicious distribution activity. The report also noted that some other unofficial sites previously distributing trojanized Aeria games had already gone inactive or removed the malicious downloads by then.
At the time of reporting, Joao was being spread through a malicious Grand Fantasia installer hosted on gf.ignitgames[.]to. The modified game loaded a malicious DLL named mskdbe.dll while allowing the game to appear to function normally.
ESET researchers uncovered a malware threat named Joao that targeted gamers worldwide by distributing trojanized versions of Aeria-published MMORPGs through unofficial download sites. The malware acted as a modular downloader that profiled infected systems and could fetch additional backdoor, spying, or DDoS components.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 63 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft Threat Intelligence reported an active malware campaign targeting gamers by distributing **trojanized gaming utilities** through browsers and chat platforms, leading victims to execute a multi-stage downloader that ultimately installs a **Java-based remote access trojan (RAT)**. The infection chain was observed staging a portable Java runtime and launching a malicious JAR (`jd-gui.jar`), while using **PowerShell** and living-off-the-land binaries such as `cmstp.exe` to reduce detection. The activity includes defense evasion by deleting the initial downloader and adding **Microsoft Defender exclusions**, and persistence via a scheduled task and a startup script named `world.vbs`; the RAT then beacons to **`79.110.49[.]15`** for C2, enabling data theft and follow-on payload delivery. Reporting also noted the campaign’s use of gaming-adjacent filenames to increase execution likelihood (e.g., `Xeno.exe`, `RobloxPlayerBeta.exe`) and emphasized that the final payload functions as a **loader/runner/downloader/RAT** rather than a single-purpose stealer, increasing the risk of secondary malware deployment. Separately, one report highlighted the emergence of *Steaelite*, a Windows RAT advertised on criminal forums with claimed “FUD” capabilities and an integrated panel combining data theft and ransomware features, underscoring broader commoditization of multi-function RAT ecosystems even when not directly tied to the specific trojanized-gaming-tools intrusion chain.
Jun 29, 2026
Kaspersky reported a malware campaign that trojanized adult “hentai” games to install a previously unknown remote access trojan, **Argamal**, on Windows systems. The attackers distributed modified game files through dedicated adult-game websites, PixelDrain links, torrent trackers including **AniRena**, and fake cheat posts on gaming forums. The infection chain relied on **DLL side-loading** and PowerShell-based download stages, then established persistence by **COM hijacking** the Windows Color System Calibration Loader task before deploying the full RAT. Argamal was described as a full-featured backdoor that used encrypted payloads hosted on **GitHub**, anti-analysis checks, and both **UDP** and **TCP** channels for command-and-control and payload updates. Kaspersky said the campaign had already infected hundreds of victims, with most cases observed in **Russia, Brazil, Germany, and Vietnam**, and noted that associated C2 domains largely resolved to `186.158.223.35`. The company assessed with medium confidence that the developer behind the downloader chain is Spanish-speaking.
Jun 29, 2026
Researchers reported that the **Guildma** banking trojan, also tracked as **Astaroth**, continued targeting users in **Brazil** through large phishing campaigns delivering ZIP archives with malicious `.LNK` files disguised as invoices, payment proofs, tax notices, and COVID-19-themed messages. The malware focused heavily on stealing banking credentials—particularly from Brazilian institutions such as **Banco do Brasil**—while also harvesting browser, email, e-commerce, and streaming credentials, capturing screenshots and keystrokes, and enabling remote-control functions. Telemetry cited one major wave reaching **up to 50,000 first-stage samples per day**, underscoring the scale of the operation in Latin America. Analysis showed a fast-evolving, multi-stage infection chain built for stealth and resilience. Guildma/Astaroth abused multiple Windows **LOLBins** including `bitsadmin.exe`, `regsvr32`, `wmic`, `rundll32`, `certutil`, `explorer.exe`, and Internet Explorer's `ExtExport.exe`, while newer variants also used the legacy `finger.exe` client over **TCP/79** to fetch commands and a signed Microsoft Silverlight binary, `coregen.exe`, for **Signed Binary Proxy Execution**. The malware employed anti-debugging, anti-VM, and locale checks to restrict execution largely to Portuguese-language and Brazil-based systems, stored or loaded modules through obfuscated JScript and alternate data streams, and retrieved encrypted command-and-control infrastructure from **YouTube channel descriptions** with fallback servers to maintain access if primary infrastructure was disrupted.
Sep 1, 2026