Web3 Game Developers Targeted in Crypto Theft Scheme

A Russian-language cyberattack campaign impersonates legitimate game operations to spread various cross-platform infostealers.

A Russian threat actor is peppering
game developers
with fraudulent Web3 gaming projects that drop multiple variants of infostealers on both MacOS and Windows devices.
The ultimate goal of the campaign appears to be defrauding victims and stealing their cryptocurrency wallets, according to Recorded Futures Insikt Group, which discovered the malicious activity.
The extensive Russian-language campaign mimics legitimate projects by using slight alterations in project names and branding — even going so far as to have multiple fake social-media accounts impersonating the projects to make them seem authentic, according to
a report
published online.
In the attack, the main webpage of a project offers or links to installation files for the purported game software, ostensibly for use by developers. However, these files instead deliver either
Atomic macOS Stealer
for Intel- or ARM-based devices;
Rhadamanthys
; or RisePro, depending on the victims operating system.
The targeted nature of this campaign suggests that threat actors may perceive Web3 gamers as having a more acute vulnerability to social engineering, due to an assumed trade-off in cyber hygiene — meaning that Web3 gamers may have fewer protections in place against cybercrime — in the pursuit of profit, according to the report.
That profit comes in the form of cryptocurrency, as the actor is primarily targeting developers crypto wallets with the intent of compromising those wallets. Web3 gaming refers to online games such as Axie Infinity and MixMob that are built on blockchain technology, which can result in financial gain for players who earn various cryptocurrencies.
As wallet compromise continues to be the biggest threat in both Web3 and cryptocurrency security … we assess that wallet compromise is likely the end goal of this campaign, according to Insikt Group. Attackers also can use credentials harvested from the malicious activity for an array of unauthorized account accesses, according to the report.
Indeed, the report outlines several social media reports of game developers falling victim to the scam and having their crypto wallets drained, including one who lost about 2.5 Ethereum, or about $8,000.
The attack campaign comes in the form of whats called trap
phishing
, whereby malicious actors duplicate and deploy Web3 project lookalikes.
Insikt researchers began investigating the malicious activity after Web3 smart contract auditor CertiK described a project in January called Astration that used fake job openings and non-fungible token NFT offerings to lure game developers into a trap-phishing campaign that spread infostealers.
The fraudulent project duplicated and recreated nearly all of the social media accounts associated with a legit project called Alteration, including reposting social-media content from legitimate accounts, establishing a direct copy of the projects Discord server, and delivering two types of malware.
Upon further research, Insikt found five additional fraudulent gaming projects, three of which were serving malicious files communicating with the same command-and-control (C2) server as those obtained from the Astration project, as well as two that were no longer active but were found to be similar to the active scams. Purported game names associated with the active projects were ArgonGame, DustFighter, and CosmicWay Reboot, while games associated with the inactive projects were Crypterium World and Myth Island.
Overall, the threat actors are delivering the campaign via a resilient infrastructure, allowing them to quickly adapt by rebranding or shifting focus upon detection, according to Insikt.
Insikt highlighted the necessity for both individuals and organizations to maintain continuous vigilance against threats and adopt mitigation strategies against campaigns that use phishing as an initial entry point. To that end, the group offered a number of mitigations in its report as well as included a list of indicators of compromise.
One is to provide comprehensive training to users — especially those involved in Web3 gaming or related industries — to recognize social engineering tactics associated with trap phishing. Game developers in particular should scrutinize the legitimacy of Web3 projects advertised on social media, according to the report.
Organizations also should educate users on the well-known risks associated with downloading software from unverified sources and the importance of verifying the authenticity of project websites before installation.
Endpoint protection solutions updated with the latest threat intelligence — such as antivirus software that are capable of detecting and blocking
known infostealer
variants like Atomic, Stealc,
Rhadamanthys
, and
RisePro
— also can help organizations avoid compromise.
Organizations should also deploy multi-platform security measures to protect against malware infections across both macOS and Windows devices, including firewalls, intrusion detection systems, and endpoint detection and response (EDR) solutions, according to Insikt.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Web3 Game Developers Targeted in Crypto Theft Scheme