Steam Users Targeted with Malware through the Platform’s Chat Utility

Security researchers have issued an alert to Steam users regarding one malware strain which cyber-crooks are disseminating through the chat system of the gaming program, published securityweek.com in news on November 17, 2014.

It maybe noted that Steam, which's one Internet-based entertainment application where software and games are run, supports over 75m user accounts.

The authorized website of Steam has been receiving many posts regarding the new attack, with account holders informing about getting messages that direct them to click on an apparently innocuous picture document.

Security Company Malwarebytes, after examining the assault, discovered that the threat often got potential victims to take down the malicious program via the perpetrators making an assertion that it was one virtual item which was being traded as they even displayed the picture of the said item. Securityweek.com reported this, November 17, 2014.

Malware Researcher Bart Blaze with Panda Security too has performed an analysis of the malware and subsequently elaborates that one screensaver file with the usual .scr label gets downloaded through the malevolent web-link. The file, in reality, is a Google Drive-loaded executable, and it disguises as certain photograph while even contains one image that closely resembles the file symbol.

Blaze points out that Google Drive Viewer most normally would get displayed so the user will be able in taking down the screensaver. Here, the web-link has an added string namely "&confirm=no_antivirus' that implies that the file would instantly emerge with the query whether the user wants to save or run it (however, it may get downloaded automatically in certain instances), Blaze warns. Techworm.net published this in news on November 18, 2014.

On 16th November 2014, Blaze reported about the malicious .scr file; however, seemingly nothing has been done to destroy it as it's yet obtainable from Google's cloud.

Fortunately, most anti-viruses do well in detecting it as well as abort its download onto any target PC. Of the total 55 VirusTotal anti-virus engines, 37 very easily isolate the malware instantly.

Blaze's analysis further suggests that the malicious program is hosted via a server based within Czechoslovakia on which the filched data is possibly stored.

» SPAMfighter News - 11/25/2014