Cybercriminals Use Fake Game Updates on Itch.io and Patreon to Push Lumma Stealer
The indie gaming community is currently facing a significant threat involving the distribution of Lumma Stealer malware via itch.io and Patreon. This malware is being disguised as legitimate game updates and is disseminated through a coordinated spam…
The indie gaming community is currently facing a significant threat involving the distribution of Lumma Stealer malware via itch.io and Patreon. This malware is being disguised as legitimate game updates and is disseminated through a coordinated spam campaign targeting users of the platform.
Newly created accounts on itch.io are posting comments on legitimate game pages, claiming to offer "game updates." These comments contain links directing users to Patreon, where archives named "Updated Version.zip" can be downloaded.
Upon extraction, these archives mostly contain benign files. However, the primary executable, "game.exe," is the actual malware payload that employs advanced evasion techniques to avoid detection.
Technical Specifications: Nexe Compilation
This campaign is notable for utilizing nexe, a compiler that converts Node.js applications into standalone PE executables. This method eliminates the need for the node.exe runtime, enhancing the malware's portability and making it harder to detect.
Decompilation reveals an obfuscated JavaScript file named "mains.js" that functions as the malware's core engine. It includes multiple anti-analysis routines designed to hinder security researchers and automated analysis systems.
The indie gaming community is currently facing a significant threat involving the distribution of Lumma Stealer malware via itch.io and Patreon.
The malware's defensive strategy includes six distinct anti-analysis subroutines:
Checking system resources: The malware halts execution if RAM is below 4GB or CPU cores are two or fewer. Searching for sandbox usernames from a predefined list, including identities like "sandbox," "vmware," and "malware." Comparing running processes against a list of over 60 malware analysis tools, including debuggers like IDA Pro, Wireshark, and Burp Suite. Examining video controller names to identify virtualization indicators such as VMware SVGA 3D and VirtualBox graphics adapters. Checking system refresh rates, terminating if rates fall below 29Hz. Inspecting disk drive model names for virtual machine identifiers.
Once these defenses are bypassed, the malware deploys its final payload using a reflective loading technique. It decodes and writes a file named "modules.node," a DLL with Node.js API export functions, to the system's temporary directory. This DLL then loads a LummaStealer variant directly into memory using Node.js APIs.
Evidence suggests a single threat actor is managing this campaign across multiple itch.io accounts. Despite efforts to remove malicious accounts, new ones continue to emerge.
Users are advised to exercise caution when downloading game updates from itch.io and verify all updates through official game developer channels rather than community comments. Security teams should monitor for nexe-compiled executables and implement robust endpoint detection for the multi-layered anti-analysis techniques employed in this campaign.
Based on reporting by GBHackers.