Phishing for teens in the Habbo Hotel

happygeek 0 920 Views

Teens just love using social networks for everything from posting naked photos online to wasting time during class at school. We also know that parents have little idea what teens get up to online but, it would appear, the teen online love affair has not gone unnoticed by young hackers who are actively targetting their fellow teenagers.

Researchers at the Imperva Application Defense Center have uncovered a new hack attack which specifically targets teens using the popular Habbo Hotel virtual world come social networking site. Since it launched in 2000, Habbo Hotel has gone on to see around 75,000 new avatars being registered daily and with monthly visitor totals of around 8 million uniques you can see why it might present an attractive target for hackers looking to spread malware or spam to a 'trusted' circle of freinds via compromised accounts.

According to Imperva ADC it was pretty easy to do the detective work that uncovered the Habbo Hotel attack. First researchers searched the T35 hosting site, favoured by certain hackers as it allows for PHP execution as well as providing sufficient free space for their nefarious purposes, using a simple filetype search for passwords stored as plain text at t35.com

This revealed a site, the URL of which I will not repeat here as it appears to still be up and running, containing a directory listing of thousands of Habbo Hotel users with data such as username, password, birthdate, email and snail mail details of both the user and their parents.

A little further digging found the alledged hacker behind the listing, openly bragging online about how the data was obtained courtesy of some simple phishing. Imperva says that the hacker had an Habbo account before being banned there by the name of chewingbum, and T35 also had a hosted site (since taken down) with the same name which acted as a phishing site for Habbo in the UK by tempting "the very young and innocent" to "give away their credentials for a promise of some game prizes".

Could it be that the people you might expect to be the savviest when it comes to online security, that is the generation that has known nothing other than a totally connected world and for whom social networking and virtual worlds are second nature, are actually more vulnerable to social engineering than you might think?

Dani AI

Generated

As flagged, virtual worlds used by teens are high-value targets because attackers exploit trust and in-game incentives. The original thread calls attention to the problem but stops short of giving clear next steps. Below is a compact, practical checklist and prevention guidance that can be applied immediately.

Immediate response (do these in order):

  1. Change the compromised account password and any other accounts that used the same password. Use a long, unique password stored in a password manager.
  2. Enable two-factor authentication (prefer an authenticator app or hardware key over SMS).
  3. If you cannot log in, follow the platform recovery flow, capture screenshots of any error or phishing pages, and open a support/abuse ticket with the game operator.
  4. Check the account for outgoing messages, invites, or posts the attacker may have sent; remove or flag them and warn the account's friends not to click links.
  5. If personal or parental financial/ID data was exposed, notify banks or card issuers and keep records; consider fraud-alert/monitoring options if sensitive identity data was leaked.

Simple prevention and teaching points:

  • Make profiles and chat private; restrict who can send messages or friend requests.
  • Teach teens to inspect URLs (hover to see targets), never enter credentials on unknown pages, and treat unsolicited "free item" offers with suspicion.
  • Use unique emails/passwords for game accounts, keep OS and browsers updated, and run reputable anti-malware.
  • Collect evidence (screenshots, message IDs, timestamps) before changes are made — it helps platform support and, if needed, law enforcement.

Good to see community concern from and — practical habits and quick response reduce damage far more than panic. These steps are low effort and keep kids safer across most social or gaming platforms.

Member Avatar for data-struction
data-struction 0 Light Poster

Thanks for sharing this article. This is horrifying.

Member Avatar for antwar1986
antwar1986 0 Newbie Poster

Thanks so much for the tips, keep posting... :D

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Edit Preview