The tap-estry of threats targeting Hamster Kombat players

ESET Research discovered cybercriminal activity leveraging the popularity of the Telegram clicker game Hamster Kombat: an Android spyware (Ratel) distributed via an unofficial Telegram channel that steals SMS, hides notifications, and accepts SMS-based commands; fake app storefronts that deliver unwanted ads; and GitHub-distributed cryptors that deploy Lumma Stealer to Windows victims. The report includes technical analysis of each threat, sample hashes, C2 IPs/domains, code and delivery details (RC4/AES-GCM embedding, process hollowing, FTP download), and MITRE ATT&CK mappings to support detection and mitigation.