First Blizzard Authenticator Hack Confirmed
Blizzard has confirmed that a work-around that allows hackers to gain access to games protected by its authenticator tool has been invented.
This is the first confirmed case of a compromised World of Warcraft account with an authenticator attached. The affected user alerted others to the issue on the official forums, which was responded to by a Blizzard rep, who confirmed that the case was genuine. Other players then reported similar experiences. Blizzard poster Kropacius informed readers that the type of problem was a 'Man In The Middle' attack.
According to information from various affected users, the hacker gains access to a player's system through a keylogger, thought to be a file named emcor.dll, which can be found in C:/Documents and Settings/Users/[username]/Application Data/Temp. Once infected, the PC will cause WoW to crash, prompting players to log back into the game. This is when the authenticator code is intercepted by the hacker, who sends on a different code to Blizzard's servers, preventing the legitimate user from gaining access to the game. In the mean time, the hacker does have access to the account until the code resets, and can proceed to steal any gold and/or possessions from your characters.
