• Call of Duty: Modern Warfare 2 is currently being used to infect players with malware.
• Players claim that entering hacked lobbies leads to a DLL being replaced with self-spreading malware.
• Activision has disabled multiplayer for the game while it investigates the matter.

Call of Duty: Modern Warfare 2 originally launched in 2009 and while it may have been remastered recently, there are a few hundred people still playing the game according to Steam Charts.

At the most recent count there were about 460 players at peak and 192 on average in June. Not setting the world on fire then, but it’s seemingly enough players to be targeted in a malware attack.

According to TechCrunch, players of the aging Call of Duty title took to Steam in June to complain about the discovery of malware after playing the game. A player claimed in June that attackers were using hacked lobbies to replace the game’s dsound.dll with malware.

The malware in question is Win32/Wacatac.B!ml which Windows says “spreads by attaching its code to other files on your PC or network.”

This is mighty concerning, so concerning in fact that Activision is dusting off the servers and investigating the matter.

“Multiplayer for Call of Duty: Modern Warfare 2 (2009) on Steam was brought offline while we investigate reports of an issue,” the Call of Duty Updates account tweeted this week.

Perhaps most concerning of all is how few endpoint security systems are able to detect this malware. Thankfully Microsoft can detect the malware, as can McAfee, Avast, Sophos, and Symantec among a few others.

It’s good to see Activision addressing the problem although we have to point out that it’s taken well over a month for them to take action.

This highlights just how important it is for developers to keep an eye on their older titles and for players to exercise caution when playing those games.

We’re not sure what surprises us more, the fact that people are still playing the multiplayer of a game launched in 2009 or the fact that attackers decided to use a game from 2009 as an attack vector.