Runescape account extender goes phishing

While Runescape is free to play, you can upgrade your account with a variety of billing options in order to gain access to features that free users cannot obtain. As a result, paid up accounts are popular targets of phishers and scammers who like to go trading accounts on forums, and sell all of your pointy wizard hats just to annoy you.

If you run the below program, you’re going to lose your pointy wizard hats.

Presenting the “Runescape Screwover”:

Click to Enlarge

While a very crude looking program, it does have a “Click here to add 30 member days” checkbox on it and that combined with endless fake Youtube comments will mean lots of people throwing their login details away.



“I’m selling membership to people now because of this” is a particularly nice touch.

Only one small problem – the program is a phisher. There are two standout clues:

1) The program has a bunch of email addresses inside it that the data is mailed to once you enter your login details.



2) The executable actually says “phisher” in the description text.



Of course, that won’t prevent some people from running the program and sending their login to Mr Pointy Hat Stealer. One to avoid? Most definitely.

We detect this as Trojan.Win32.Runeover.A.

Christopher Boyd