The phishing website fronting as a Pokémon Card Game is incredibly malicious to users.
Cybersecurity analysts have warned Pokemon fans against confusing malware disguised as Pokemon NFT games. South Korea’s AhnLab’s Security Emergency Center (ASEC) has identified a malicious Pokemon Card Game that could put your personal information and device control at risk.
According to the ASEC, cybercriminals have created a phishing website with a fake version of the Pokemon Trading Card Game and a marketplace to lure fans into downloading malware onto their devices. The phishing website has themes and features you’d expect on a site dealing with the Pokemon game as you can see in the image below. However, clicking the “Play on PC” link would initiate malware installation into your computer.
Cyber experts note how the attackers did their best to go unnoticed, especially among young users. They’ve connected the fake game to a fake website, and even included a fake marketplace purporting to offer Pokemon Card NFTs. Any interaction with a phishing website or clicking the “download to PC” button starts downloading an installer immediately with a NetSupport Manager tool buried into files instead of the Pokemon Go game.
ASEC analysts say the NetSupport Remote Admin Tool (RAT) helps attackers access private user data and opens a back door, making your PC even more susceptible to malware. Generally, a NetSupport Manager tool is commonly used by hackers to gain remote control of your devices, including the keyboard and the mouse. As a result, they can access crucial information, possibly even tweaking it to further explore your device and online life.
Young users are the most likely to fall prey to this trap, given the official-looking file information and Pokemon icon accompanying the malware download. Nintendo’s previous mention of plans to indulge in NFTs and metaverse could also cause users to fall into the malicious scam, but the Pokemon company has since remained mum on the issue.
Hackers will try their best to lure you into a malicious link that paves the way for more malware and invasion of your privacy. No matter the perfect-looking appeal on most sites you come across online, you need to play safe and avoid clicking anything that looks real.
“When installing externally sourced software, users are advised to purchase or download them from their official websites and refrain from opening attachments in suspicious emails. Users should also apply the latest patch to programs such as their OS and internet browsers and update V3 to the latest version to prevent malware infection in advance,” says ASEC.
