Official releases for the League of Legends and Path of Exile online games were found laced with a nasty trojan after attackers compromised an Internet platform provider that distributed them to users in Asia.

The compromise of consumer Internet platform Garena allowed the attackers to attach malicious software components to the official installation files for the two games, according to a blog post published Monday by antivirus provider Trend Micro. In addition to the legitimate game launcher, the compromised executable file also included a dropper that installed a remote access tool known as PlugX and a cleaner file that overwrote the infected file after it ran.

According to Trend Micro, the attackers took care to conceal their malware campaign, an effort that may have made it hard for victims to know they were infected. The cleaner file most likely was included to remove evidence that would tip users off to a compromise or the origin of the attack. The cryptographic hash that was included with the tampered game files was valid, so even people who took care to verify the authenticity of the game installer would have no reason to think it was malicious, Trend Micro researchers said. The researchers linked to this December 31 post from Garena. Translated into English, one passage stated: "computers and patch servers were infected with trojans. As a result, all the installation files distributed for the games League of Legends and Path of Exile are infected."

PlugX is a remote access tool that allows attackers to maintain persistent access to infected computers. Once installed, attackers can steal passwords, keystrokes, and other data and install new malicious titles at will. In the past, PlugX has specialized in targeting legitimate apps used by Microsoft, Lenovo, and McAfee. Those attacks worked by exploiting a vulnerability found in executable files when dynamic link library files are loaded.

League of Legends and Path of Exile have a combined base of at least 75 million people. Fortunately, the PlugX infection affected only a small portion of those users who were mostly located in Taiwan. Attacks like these are worth paying attention to, since they have the ability to infect large numbers of people who are following good security hygiene.