From r/Genshin_Hacked by u/genshin-hacked
How the Account Stealing Works
DISCLAIMER
The Author don't resell accounts. The Author just an enthusiast who decided to figure out how this stuff works in case of Genshin.
I want to tell you a little about how the account theft process works because I know it from the inside. Maybe it will give you insights on how to better protect yourself. I'll give you some tips, too. I will talk about the Russian market, because it is very active and I see that many people here write that their email has been changed to Russian ones.
WHERE THE ACCOUNTS FROM
The market for stolen accounts always specifies the origin of the account - that is, the way the hacker gained access. Judging by statistics (I've analyzed a lot of offers on the market), 80% of the time it's a stealer. A stealer is a program (virus) that just needs to be run once on a computer to gain access to a huge amount of information.
HOW STEALERS ARE DISTRIBUTED
There are several popular stealers (all of them paid), and almost all can penetrate the system undetected by antivirus. They are set up so that even VirusTotal will not find threats there. (When I tested it, my antivirus did not react to the program in any way).
By the way, one of the popular tricks to bypass VirusTotal is to put a password on the archive with the virus.
So never download archives with a password, and dubious programs from strange links, unless you trust the source by 120%. That said, the source where you might have downloaded the virus might not be thematically related to Genshin in any way.
How Stealers Are Distributed :
- In the links under the YouTube videos. Most often these are videos about cheats, fps enhancers, free bonuses in the game, etc.
- on Facebook
- on Thematic forums
WHAT KIND OF INFORMATION CAN BE OBTAINED VIA A STEALER
- All saved passwords from the default browser
- List of installed programs, a list of all browsers and browser profiles
- List of running processes
- Computer user information, including location
- Autofill forms data
- And most importantly, COMPLETE SET OF COOKIES OF ALL BROWSERS / BROWSER PROFILES.
Thus, if you share a computer with other people (e.g. your ten-year-old brother who decided to download game cheats), the hacker will get information about you as well.
HOW THEY BYPASS 2FA
THEY USE COOKIES.
All you have to do is load a ready set of cookies into a clean browser and you can access the email. You don't even have to enter email password to do this. Accordingly, no 2FA will be triggered, because the browser will assume that you were originally logged into the mail.
Also, you will not get a notification of logging in from the new device, for the same reason. Again, if you share a computer with someone else, you put yourself at risk here. Of course, sometimes this method doesn't work because the cookies may have gone stale. After that, stealing your Genshin Impact account is very easy.
Now a couple of tips to help you protect yourself a little better :
- Don't save the password for your HoYoverse account and the email your account is linked to in your browser. Use a password manager. Many antivirus programs offer them.
- Clear cookies regularly. If you suspect you might catch a virus somewhere, it's best to do it once every 24 hours.
Make sure to read another related content
1. What You Should Do If Your Account Got Hacked
2. A Guide to Secure Your Genshin Impact/HoYoverse Account
- Part 1 | How To Secure Your Account
- Part 2 | How Do We Get Hacked?
- Part 3 | How Can I Secure My Account Better?
3. How Scammers Work in Genshin Impact and How to Detect Them
4. How the Account Stealing Works
5. Beware of Giveaway Scam
6. Frequently Asked Questions
Kamisato Ayaka fanart by Koki (@koki0161023)
