In metaverse, users are able to hide their identity behind an avatar, potentially allowing criminals to pose as 10-15-year-olds, groom children and offer face-to-face meetings in the real world. This emerging space also presents new openings for threat actors to exploit inexperienced and unaccustomed computer users for monetary gain through targeted phishing and social engineering cyberattacks. Children and adolescents with a lack of cybersecurity knowledge potentially also become one of the main targets of such attacks.
Few people consider children actively spend up to six hours-a-day participating in their own virtual gaming online metaverse. And while virtual online universes have been around for a long time, with gamers playing and chatting with friends and strangers from all around the world, the threats that potentially exist for children in the metaverse are much more prevalent here.
In this report, we have analyzed the latest statistics on cyberthreats targeting young gamers and provide an overview of the most well-spread threats for children in virtual gaming worlds that players and their parents must be aware of.
Despite the number of affected users and distributed files decreasing slightly in 2022, cybercriminals have not abandoned this attack vector. In addition, the number of attempts in 2022 increased compared to the year before. In total, Kaspersky security solutions detected more than 7 million attacks from January 2022 and December 2022. In 2021, cybercriminals attempted 4.5 million attacks, resulting in a 57 percent increase in attack attempts in 2022.
Minecraft and Roblox are among the most popular games for children and teenagers allowing them to play in virtual worlds with friends and strangers, and are the titles most exploited by cybercriminals in 2022 and 2021.
Traditionally, Minecraft has been the most targeted by cybercriminals. In 2022, more than 140,000 users encountered attacks while trying to download Minecraft-related files. In the gaming community it is common to use cheats and mods allowing you to update and customize your virtual world. This exact feature is used by fraudsters who distribute malware and unwanted applications under the guise of additional functions and mods in Minecraft.
In addition to generating in-game currency, young gamers are also offered to boost their rank in games. On one of the discovered pages, users can choose which of their characters in Apex Legend they want to boost and to what rank. However, unlike previous examples, this help is not free. Besides the data from their game account, the player will also need to pay for the boost through PayPal. It is unknown whether users will really get the boost, thus, gamers should always treat such offers with doubt: these are temporary sites on freshly created domains, with no official documentation and it is not known if the offer is really legitimate.
To convince players to use this platform to boost their rank, the creators of the page even cited the average price of such a service offered on other sites appearing in the first 10 searches on Google, and compared it to theirs, which is much lower. However, this might be just a clever marketing ploy to lure users into a trap.
Kaspersky also found numerous offers to download games loved by millions of children from third-party sites, rather than official stores. Along with the desired game, fans also get unwanted applications or even malware, silently collecting data from the infected device.
Besides the entire apps, cybercriminals also offer to download popular cheats and mods for games. In addition to the download button, they also add to the phishing page a video example of how the cheat will help users in the game. For example, to move more efficiently than other players or take less damage from an attack.
Cyberbullying is unfortunately fairly common among children and adolescents in gaming, and can take place between kids that know one another, such as classmates at school, or between strangers. They may leave intimidating voice chats or texts in the chat function, or make someone lose a game on purpose.
If someone is not performing well in a game, other players may curse or make negative remarks that can turn into bullying, or even exclude the person from playing together. Anonymity of players and the use of avatars allow users to harass, bully, and sometimes gang up on other players. A study carried out by an anti-bullying charity found that 57 percent of young people had experienced bullying online when playing games. In addition, 22 percent said they had stopped playing a game as a result. Even though the bully is in the wrong, many teens feel too embarrassed or ashamed to speak up to ask for help.