Microsoft says this Chinese ‘gaming service’ company is hacking Xbox accounts

Since 2015, a Chinese gaming website has been hacking Xbox accounts and selling the proceeds on the open market, according to a complaint filed by Microsoft in federal court on Friday.

 

On its website, iGSKY presents itself as a gaming service company, offering players a way to pay for in-game credits and rare items — but according to Microsoft, many of those credits were coming from someone else’s wallet. The complaint alleges that the company made nearly $2 million in purchases through hacked accounts and their associated credit cards, using purchases as a way to launder the resulting cash. On the site, cheap in-game points are also available for the FIFA games, Forza Horizon 3, Grand Theft Auto V, and Pokémon Go, among others.

“Microsoft is committed to providing customers with safe and secure online experiences,” a company spokesperson told The Verge. “We filed these lawsuits to protect our Xbox customers from the illegal trafficking of stolen property.” 

Microsoft’s in-house fraud investigators began looking at the site in December, making a number of purchases on iGSKY to build the case. In one case described by senior investigator Jeremy Beckley, Microsoft’s fraud team purchased 11,000 FIFA points on iGSKY.com, paying $60. Immediately afterward, Xbox Live received an email and password change for an eight-year-old account, which then proceeded to purchase 11,000 FIFA points for $127.54. It’s unclear how the group gained access to the account, although there was no indication of a broader breach of Xbox services.

iGSKY delivered the credentials to Microsoft’s investigations team in an email, along with instructions to spend the points as soon as possible. Shortly after that, the original owner of the account contacted Xbox customer support, complaining that he had been locked out of his account and unauthorized purchases had been made.

Based on that evidence, Microsoft has brought charges of fraud, CFAA violations, and racketeering conspiracy under RICO, naming alleged parent company Gameest and alleged proprietor Weiwei Chu. Still, Microsoft acknowledges it knows little about how iGSKY is operated, and hopes to turn up more detail in discovery.

Since iGSKY is based in China, it will be difficult to directly shut down the site — but the court can still make lift difficult. Judge Koh has already issued a temporary restraining order freezing the company’s domestic assets, including any PayPal accounts linked to the site. Further arguments are scheduled for next week.

The article was published on : theverge