A hacker has found a way to exploit a vulnerability in the popular PC game Dota 2 and create malicious game modes that could infect players’ computers with malware. The hacker used an outdated version of the V8 JavaScript engine that was used by Dota 2 to run custom game modes created by the player community.
The V8 JavaScript engine had a flaw that was discovered and fixed by Google in 2021, but Dota 2 had not updated its version until January 2023. The flaw allowed the hacker to execute arbitrary code on the players’ systems without their knowledge or consent.
The hacker published at least four malicious game modes on the Steam store, which were downloaded by unsuspecting players. The game modes were named “test addon plz ignore”, “Overdog no annoying heroes”, “Custom Hero Brawl”, and “Overthrow RTZ Edition X10 XP”. The first one contained an exploit code that could log information from the players’ systems and run commands. The other three had a backdoor that could download and execute more malicious code from a remote server.
The antivirus company Avast discovered the hacker’s activities and reported them to Valve, the game publisher. Valve fixed the vulnerability by updating the V8 engine and removed the malicious game modes from the store. According to Valve, only 200 players were affected by the hacker’s attack.
The hacker’s motives and identity are unknown, but Avast suspects that they were not just doing it for fun or research. The hacker could have used the exploit to steal personal data, install ransomware, or recruit botnets from the players’ systems.
