Legion Tool Steals PUBG Players’ Browser Passwords through a Fake GitHub Repo

“The Legion” is a Python-based software that has been crafted with the explicit intention of gathering credentials.

Its propagation initially occurred via Telegram channels, where it was advertised as a tool that could be used for hacking.

The tool is well-known for its ability to steal users’ login credentials from a wide variety of services.

Researchers from Cyble uncovered a GitHub page that mimics a PUBG hack but downloads the stealer malware.

PUBG Hack as Malware

Players are tempted to download the hack as it helps them to gain an unfair advantage over other players.

These bypass hacks are designed in the way to bypass the game’s security measures and anti-cheat systems and help them to enable various cheats and hacks.

Below is the fake page that mimics a Pubg Bypass hack.

The downloaded zip file drops various files, including “source code (.cs), project (.csproj), solution (.sln), icon (.ico), resources (.resources), and other supporting files like app.config, desktop.ini, and Readme.md.”

A file name “Karogour_BypasrcS.sln,” upon execution, drops “Local_ycsNYnaBZ(.)sln” and “LocalchfRgyVJSk(.)exe”.

The “Local_ycsNYnaBZ.sln” file opens the Visual Studio editor to trick the user; in the meantime, LocalchfRgyVJSk(.)exe got executed in the backend, and the executable is Legion Stealer.

The stealer “executes a series of commands, which include manipulating Windows Defender settings, extracting information from the registry, and gathering system details,” read the report.

The stealer gathers system information such as computer name, OS name, RAM size, UUID, CPU details, GPU details, and product key.

Also, other information such as IP address, region, country, time zone, cellular data connectivity, proxy/VPN usage, and reverse DNS.

The stealer also targets Crypto wallets and steals passwords from browsers, namely Brave, Chrome, Chromium, Comodo Dragon, Edge, Epic Privacy, Iridium, Opera, Opera GX, Slimjet, UR Browser, Vivaldi, and Yandex.

The stealer generates an overview of the stolen data and compresses the folder, and exfiltrates it to the Discord servers.

“AI-based email security measures Protect your business From Email Threats!” – .