Someone is passing around Valorant beta keys that are actually malware

Hackers are trying to exploit widespread interest in a buzzy, new video game in an attempt to steal gamers’ username and password credentials.

Attackers are disguising malicious software that looks like a product licensing key that would grant a user access to the beta version of “Valorant,” a new title from the developer Riot Games. However, the game-key generator actually includes keylogger software that would allow hackers to track the words and phrases that users type. Albert Zsigovits, a threat researcher at the security firm Sophos, disclosed the issue in a tweet Wednesday that attracted attention from other malware specialists.

Riot Games did not respond to a request for comment by press time.

It remains unclear when hackers first launched the hacking tool, though they apparently used a known nefarious site on Pastebin, a site where developers store code. The antivirus provider Kaspersky also flagged the Pastebin page in question as malware, according to a listing on the VirusTotal database. Another security tool, MalSilo, also flagged the URL as malicious, though most security companies classified it as clean.

The number of victims who may have inadvertently downloaded the keylogger also remains unclear.

The attack couldn’t have come at a more opportune time. In a blog post Tuesday, Riot Games described how gamers could play Valorant, currently in closed beta, could do so by obtaining a key. The developer said it had increased its server loads by 25% to accommodate demand, while some 200,000 viewers previously watched a livestream of gameplay, where new keys are distributed, according to the Verge.

It’s common for hackers to try to capitalize on cultural trends that generate lots of attention, especially if it’s a game or contest that might cause unwitting users to overlook red flags. Last year Epic Games, the developer behind the massively popular game “Fortnite” had announced it had fixed a web vulnerability that would have allowed hackers to access other users’ accounts.

The same opportunistic mentality has resulted in an influx of COVID-19-related hacking attempts, as scammers try to exploit anxieties related to the coronavirus.