Hearthstone cheats and tools spiked with malware

Symantec researchers say some downloads hurt more than help

Current Job Listings

Researchers at Symantec are warning Hearthstone players about a number of add-on tools and cheat scripts. While some of the tools are designed to help players, Symantec discovered that a majority do little more than compromise a player's system.

Hearthstone, for those unfamiliar, is a card game based off Blizzard's World of Warcraft. The game is free-to-play, but most players spend actual cash to purchase additional cards. However, for those who don't want to spend money, there are tools available that help players acquire gold and card crafting materials (dust).

Researchers at Symantec have discovered a number of the popular Hearthstone cheats are being spiked with malware that targets Bitcoin wallets, or create a backdoor into the player's system.

In one example, Hearth Buddy (*see update), a tool that allows bots to play the game instead of a human player (which is supposed to help with rank earnings and gold earning) compromises the entire system. Another example, are the dust and gold hacking tools (Hearthstone Hack Tool), which install malware that targets Bitcoin wallets.

Blizzard takes a harsh stance against cheaters, but that doesn't stop people from attempting to scam the system. Now, not only are they risking the loss of their account, players are facing financial losses and system ruin.

For players that use deck-tracking software, which is frowned upon, and banned at Blizzard's discretion, criminals have released their own malicious versions that install backdoors in a player's system.

"A lot of Hearthstone players would consider the use of deck trackers as cheating. Blizzard does not usually endorse third-party applications that mine its games," Symantec notes.

"However, deck tracker add-ons are widely used by popular streamers who broadcast their Hearthstone matches on Twitch. This has led many of their viewers to do the same. Cybercriminals have released their own malicious deck tracker add-ons. As Blizzard doesn’t support these tools, they are as susceptible to malware as any other third-party modification in the game."

Attempting to cheat at Hearthstone is bad enough, but now there is an additional penalty for shady players. Best bet, just play the game normally and avoid the hassle.


On Wednesday, February 10, a day after this story ran, Symantec backtracked their references to one of the tools used by Hearthstone players. Their full statement is below. The link to their research blog is here.

"A previous edition of this blog featured an image of the HearthBuddy bot software purchase and download page. This was just shown to provide a general example of an available bot. Symantec did not suggest (nor intend to suggest) that HearthBuddy itself contains malware. Symantec apologizes for any confusion.”

SUBSCRIBE! Get the best of CSO delivered to your email inbox.