In a blog post, researcher Ignacio Sanmillan said NoxPlayer was part of Hong Kong firm BigNox's product range and claimed to have more than 150 million users across the globe. The campaign has been given the name Operation NightScout.
However, he pointed out that though this user base was claimed to be spread across 150 countries where more than 20 languages were spoken, a majority of the NoxPlayer base was in Asia.
NoxPlayer is normally used for playing mobile games from a PC and Sanmillan said three different malware families had been distributed through customised malicious updates to selected victims.
"We spotted similarities in loaders we have been monitoring in the past with some of the ones used in this operation, such as instances we discovered in a Myanmar presidential office website supply-chain compromise on 2018, and in early 2020 in an intrusion into a Hong Kong university," Sanmillan wrote.
He said BigNox had denied being affected when it was contacted by ESET.
The indicators of compromise were first seen in September 2020 and the activity was monitored until 25 January 2021 when malicious activity that was explicit was noticed. At that point, BigNox was informed.
Sanmillan said there were very few victims in relation to the overall number of active NoxPlayer users.
"According to ESET telemetry, more than 100,000 of our users have Noxplayer installed on their machines. Among them, only five users received a malicious update, showing that Operation NightScout is a highly targeted operation. The victims are based in Taiwan, Hong Kong and Sri Lanka," he wrote.
The researchers were unable to find any common factors between the victims, but based on the compromised software, they concluded that the targets were limited to the gaming community.
Sanmillan's post detailed the method of infection, the specifics of the three malicious updates, and indicators of compromise.
"We have detected various supply-chain attacks in the last year, such as Operation SignSight or the compromise of Able Desktop among others," he wrote.
"However, the supply-chain compromise involved in Operation NightScout is particularly interesting due to the targeted vertical, as we rarely encounter many cyber-espionage operations targeting online gamers."
