Squid Game scams, malware pop up online to lure fans — what you need to do

The massive popularity of the Netflix show Squid Game has been noticed by cybercriminals who are crafting Windows and Android malware to take advantage of the show's appeal.

"Squid Game themed Android Joker," tweeted ESET security researcher Lukas Stefanko last week, warning of a new variant of the Joker premium-SMS malware in the Google Play App store. "Running this app on device might result in malicious ad-fraud and/or unwanted SMS subscription actions."

• Squid Game ending explained — unraveling all the twists
• The best Windows 10 antivirus programs
• Plus: How to make your Android phone charge faster

Meanwhile, rival antivirus firm Kaspersky said its researchers had recently found "several dozen different malicious files on the web with names mentioning Squid Game" that included "Trojans, adware, fake streams and even phishy offers of Halloween costumes."

“The Squid Game becoming a new hit lure was just a question of time," said Kaspersky's Anton V. Ivanov. "As with any other trending topic, cybercriminals have a good hunch about what is going to work and what isn't."

How to avoid Squid Game scams

To avoid being infected by or lured in by Squid Game scams or malware, don't download or install anything on a Windows PC that offers to show you pirated episodes or show-related games. 

On Android, stick to the official Google Play store and don't get apps from other sources. And make sure you're running some of the best Windows 10 antivirus programs and one of the best Android antivirus apps.

Many of the malicious files pretend to be episodes of the show or related animated clips, luring in people who don't have Netflix accounts or who just can't get enough Squid Game. 

Most are in fact "downloaders" that can install more malicious files on Windows systems, Kaspersky said. Some steal passwords and other sensitive information from desktop web browsers.

Kaspersky described a Squid Game-related Android Trojan that opens new browsers tabs or secretly sends out SMS messages from infected phones, perhaps spam or new links to download itself. 

"This Trojan is distributed in unofficial app stores and various portals under the guise of other popular applications, games, and books," Kaspersky said.

The malicious app mentioned by Stefanko, however, has been removed from the Google Play Store. 

Bogus Squid Game Halloween costumes

Another danger, warned Kaspersky, is fake Squid Game online stores. Reports of shortages of Squid Game Halloween costumes may be creating more demand, and fraudulent retailers are springing up offering just such items.

But, says Kaspersky, "when shopping on such sites, users risk not receiving the merchandise and losing their money."

"Moreover, targets end up sharing with cybercriminals their banking and personal identity information since they are asked to provide card details and personal data, including an email address, residence address, and full name."

In the most 2021 scam of all, several websites found by Kaspersky let visitors play online versions of Squid Game competitions in order to "win" prizes in cryptocurrency such as 100 Binance coin. (Binance is under investigation by the U.S. Department of Justice and the Internal Revenue Service for possible tax evasion and money laundering.) 

It seems that competitors have to also provide some personal details, which are at risk from this phishing scheme.

"Needless to say, the player never receives the promised reward and ends up losing their data or downloading malware," Kaspersky said.