There’s a certain sense of accomplishment that comes with playing MMOs, whether it’s your top-of-the-line gear from the hardest raids or piles of gold you earned through crafting and smart trading. For all of the hard workers in an MMO, there are always the scammers, who seek to separate players from their hard work, usually through deception and hacks. Unfortunately for World of Warcraft players, a new security vulnerability has come to light that lets scammers access almost every aspect of your character and trade all of your items to you, without you ever knowing.
This con lies in exploiting the makeup of the game itself, with scammers able to make use of Lua scripting to provide inputs that control the game’s UI. The gateway to the hack is a simple command, which may be done by either a malicious addon or a scammer tricking the player into entering the command “/run RemoveExtraSpaces=RunScript”. From there, your game is open to them, allowing them to then run any other command on your game via the chat window, even hiding it so you’re unaware of what they have done. The scammer will then be aware of wherever you go to and then when you get in range of them, transfer all of your gold, weapons and other miscellanies to their own character. They can even make use of your chat interface to continue the scam to your friends by impersonating you and getting them to enter the command too.
Thankfully, Blizzard has included a patch for the game that displays a warning message when the Lua script is entered, however should you accept and dismiss it, it’s gone for good so make sure to think twice before ignoring warnings about losing your gold and other items!
The warning pops up when the player tries to run ANY script, not just this one, so if they have already accepted and dismissed it on something non harmful, it won’t warn them about this one… Blizzard should just disable this specific command entirely, it has no reason to exist.