ESET warns against copycats and fraudulent apps that take advantage of Hamster Kombat’s popularity

July 25 (Portaltic/EP) –

Cybersecurity firm ESET has warned about the interest that the game has generated Hamster Kombat in cybercriminals which has led to the proliferation of imitations and fraudulent applications that hide malware to infect computers and steal sensitive user data.

Hamster Kombat is a game with a simple mechanic based on clicking on the device screen to make a hamster rise through the corporate ranks. Its popularity has also grown with the promise of making money when the creators of this title release a new cryptocurrency linked to it.

Cybercriminals have also set their sights on this game, as researchers from ESET Research have warned, who have recently discovered threats that affect both Android and Windows users, as reported in a press release sent to Europa Press.

Specifically, they point to the appearance of imitations, which replicate the name and icon of Hamster Kombat and offer similar gameplay. Although these cases are, for the most part, not malicious, they have also identified a number of threats.

On the one hand, on Android, ESET has identified and analyzed two types of threats, one of them a malicious application that contains Ratel spyware and fake websites that mimic app store interfaces, claiming to have Hamster Kombat available for download.

ESET researchers also found a Telegram channel that distributes Ratel disguised as Hamster Kombat. This malware is capable of stealing notifications and sending SMS messages, which malicious actors use to pay for subscriptions and services with the victim’s funds, without the victim realizing it.

Although Hamster Kombat is a mobile game, ESET also found malware that abuses the game’s name spreading on Windows. The research revealed GitHub repositories offering Bot farms and autoclickers -tools that automate in-game clicks- for Hamster Kombat.

However, these repositories actually hid the information thief ‘Lumma Stealer’, offered as malware-as-a-service and available for purchase on the dark web and Telegram, it targets cryptocurrency wallets, user credentials, two-factor authentication browser extensions, and other sensitive data.