This “indie game” is actually password-stealing malware

Hackers are now hiding malware inside fake video games to steal your logins.

Gamers have a new threat to worry about – an info-stealing malware named AgeoStealer. This custom-built malware masquerades as a downloadable game and is specifically designed to rip through your browser, lift your saved logins, and phone everything home to hackers in real-time.

According to researchers at Flashpoint, AgeoStealer is the latest grim twist in an already booming underground business. Infostealers are having a record year – they’re responsible for an estimated 2.1 billion stolen credentials in 2024 alone. That’s 75% of all breached login info. And now they’re coming for the gaming crowd.

Here’s how it works: a hacker slides into your DMs on Discord or some other gamer-friendly platform, offering early access to a game to test it. You download what looks like a password-protected zip file. It even has a signed Unity installer. But once opened, the package runs malicious code.

AgeoStealer targets browsers like Chrome, Firefox, and Edge, searching for credentials or wallets to steal. It also wipes session tokens, personal files, and other browser-stored sensitive information in real time, quietly uploading everything to GoFile.io for remote pickup.

AgeoStealer poses a major security headache, not just because it steals data, but because it does it without setting off alarms. Users of infected devices are at risk of identity theft, corporate spying, or even empty crypto wallets.

Gaming is one of the most exploited categories on the internet, from cracked games loaded with Trojans to scam mods that turn your PC into a zombie node.

Gamers are an easy but precious target for attackers. People let their guard down around hobbies, especially when they’re excited to be part of something new or exclusive. This is a golden opportunity for attackers who understand how to manipulate trust and hype.