Scammers cashing in on Twitch botnet malware

Twitch, a popular online video service, has recently been compromised by scammers that have turned users’ computers into botnets to augment their network of bots for rent-out to users who want to feign huge Twitch channel audience.

Users of the platform are able to live-stream their gaming sessions over the internet. The service attracted 100 million unique visitors last year who viewed some 16 billion minutes of videos posted by 1.5 million broadcasters. The catch is, the more audiences a broadcaster has, the bigger the revenues through various means.

First, a Twitch user can earn money by either having viewers subscribe to their channel for premium access on a monthly basis, receiving donations from viewers or hosting ads on their channel. Essentially, this only works for channels that have a wide viewership.

Taking advantage of this money-making scheme, other broadcasters have come up with an artificial way to inflate their audience. Researchers at Symantec found that most Twitch users have resorted to the botnet market to raise their revenue from fake views. It has been discovered that those botnets work to infect computers with malware in order to make them stream Twitch videos even in the background, thus making it appear that some legit user is viewing a game session when there is none.

In fact, there is now an online market dedicated to catering to the needs of Twitch users who want to blow up their viewership even more with a throng of bots. An easy way to earn money. These bots have gone for sale in underground forums and even on open web platforms. There’s even a customer service set up for clients, giving the underground botnet market a professional look to it.

The Twitch botnet found in the wild is called Trojan.Inflabot, which disguises itself as a Chrome or Adobe software update. The malware connects to the malware author’s community page in vk.com, a Russian social network, once it hits a target computer. The community page contains a link to the server that provides details about the target Twitch stream.

Each computer infected with the botnet is made to view five streams at a time, even when that stream is hidden so that the owner of the infected computer is not aware of the crime.

The Trojan.Inflabot is labeled with a low risk status, so it could be easy to wipe it out from your computer. You can run a full scan using your anti-virus program or replace the infected Windows system file with the Windows installation CD.