ThreatLabz uncovered a campaign distributing Tweaks (Tweaker), an infostealer targeting Roblox users via YouTube and Discord. The malware masquerades as FPS optimization tools, exfiltrates data through Discord webhooks, and even offers paid variants.
#Tweaks #Tweaker #Roblox #YouTube #Discord #FPS
#Tweaks #Tweaker #Roblox #YouTube #Discord #FPS
Keypoints
- The Tweaks or Tweaker stealer masquerades as a tool to enhance frames per second (FPS) for Roblox users that steals data in the background without the user’s knowledge.
- The attackers leverage YouTube by enticing users to watch videos on “How to increase FPS” that contain links to their Discord groups. Once users join these groups, the attackers provide them with links to malicious files disguised as game tweaks and modifications.
- The stealer is Powershell-based and exfiltrates sensitive data like user information, location, Wi-Fi profiles, and passwords, Roblox IDs, and in-game currency details.
- Once sensitive data is obtained, it is sent via a Discord webhook to the attacker-controlled server. ThreatLabz researchers discovered multiple attackers copying a “free” version of Tweaks and using it to sell “paid” versions.
- Case studies show a BAT-based delivery chain (Case Study 1) and a ZIP-packed EXE variant (Case Study 2) used to deploy Tweaks and harvest data.
- The malware’s capabilities include stealing Wi‑Fi profiles/passwords, UUIDs/usernames, user location, IPs, time, system info, Roblox ID, and in-game currency details.
MITRE Techniques
- [T1566] Phishing – The attackers use YouTube videos on FPS to lure users into joining Discord groups and downloading malicious files. Quote: “The attackers leverage YouTube by enticing users to watch videos on ‘How to increase FPS’ that contain links to their Discord groups.”
- [T1082] System Information Discovery – The malware leverages Windows Management Instrumentation (WMI) to collect UUIDs and usernames along with the user’s location including the following fields: country, region, city, and approximate location. Quote: “The malware leverages Windows Management Instrumentation (WMI) to collect UUIDs and usernames along with the user’s location including the following fields: country, region, city, and approximate location.”
- [T1064] Scripting – The stealer is Powershell-based and exfiltrates sensitive data like user information, location, Wi-Fi profiles, and passwords, Roblox IDs, and in-game currency details. Quote: “The stealer is Powershell-based and exfiltrates sensitive data like user information, location, Wi-Fi profiles, and passwords, Roblox IDs, and in-game currency details.”
- [T1010] Application Windows Discovery – The malware leverages Windows Management Instrumentation (WMI) to collect UUIDs and usernames along with the user’s location including country, region, city, and approximate location. Quote: “The malware leverages Windows Management Instrumentation (WMI) to collect UUIDs and usernames along with the user’s location including the following fields: country, region, city, and approximate location.”
- [T1047] Windows Management Instrumentation – The malware leverages Windows Management Instrumentation (WMI) to collect UUIDs and usernames along with the user’s location including the country, region, city, and approximate location. Quote: “The malware leverages Windows Management Instrumentation (WMI) to collect UUIDs and usernames along with the user’s location including the following fields: country, region, city, and approximate location.”
- [T1016.002] Wi-Fi Discovery – The Tweaks malware can steal Wi-Fi profiles and passwords. Quote: “The malware can steal Wi-Fi profiles and passwords.”
- [T1016] System Network Configuration Discovery – The malware collects IP information like private and public IP addresses, the current time, system information, Roblox ID, and currency information. Quote: “The malware collects IP information like private and public IP addresses, the current time, system information, Roblox ID, and currency information.”
- [T1059] Command and Scripting Interpreter – The Tweaks malware is Powershell-based. Quote: “The Tweaks malware is Powershell-based.”
- [T1018] Remote System Discovery – Not explicitly described in the article’s actions; technique listed in the article’s MITRE mapping as part of the overall framework. Quote: “MITRE Techniques” section lists multiple techniques including Remote System Discovery.
- [T1562] Disable or Modify Tools – The campaign includes instructions to disable antivirus software to facilitate infection. Quote: “Roblox players were instructed to disable their antivirus software to ensure the smooth operation of a ‘PC optimizer’…”
Indicators of Compromise
- [MD5] File hashes – e35864892846be3462139f9534d5ddb5 (EXE), 0e8d32259b06ab01cd04587b1ae5d0c1 (BAT)
- [Webhook URL] Exfiltration endpoints – https://discord[.]com/api/webhooks/1193562861071511683/Y3e960iiIYKeT-2hq8c0VDuprdKTD3u5F1f0AKfPQnQde8CoXnK2HzVoVGb6mBgXTsc6, https://discordapp[.]com/api/webhooks/1197341553404956752/xoPYo_fCPQGLsUIBrreFz05R9JuX_K4L96ResReZ7oLtj1za6QSYlCuMnTB8raMpVqCw
- [YouTube Channel] Distribution sources – https://www.youtube[.]com/@cartistweaks/videos, https://www.youtube[.]com/@fraidtweaks