ESET has discovered the ‘PokerAgent’ botnet that was designed to harvest Facebook log-on credentials, collecting information on credit card details linked to the Facebook account and popular Zynga Poker player stats, presumably with the intention to mug the victims. The Trojan managed to steal the login credentials of more than 16,000 Facebook users in 2012.
ESET Security Research Lab has discovered an attention-grabbing Trojan horse about a year ago. ESET has been detecting the different variants of the Trojan generically as MSIL/Agent.NKY. The malware focused on stealing personal Facebook (FB) login details and linking these with the user statistics of Texas HoldEm Poker, a very popular FB application by Zynga Inc., in case the victim plays this game.
According to data from ESET LiveGrid, a cloud powered real-time protection scanner, precisely 99% of all detections of Trojan were coming from Israel. ESET has contacted Israeli CERT (Computer Emergency Response Team) as well as Israeli police in early 2012. During the investigation ESET could not provide any details about this threat publicly and presently this threat has been deactivated.
The game had a functionality that allowed replenishing the chip value using real money by inputting the credit card details or PayPal account. To gain the user’s login credentials, an army of 800 of computers were used – all infected and controlled by the attacker. These machines were executing commands from the C&C (Command&Control) server. The creator of the threat has launched an attack using the login credentials of several FB accounts, which were gained ahead of time.
