From Free Game Cheats to Arson: Cybercriminals Recruit Children for Espionage and Violent Crimes

Cybercriminals are increasingly targeting children not only to steal money from parents but also to turn them into unwitting accomplices in dangerous criminal activities. During school holidays, teenagers spend more time in games and messengers where scammers offer free in-game currency, mods, cheats, and pirated game versions to build trust. Once access is gained, fraudsters extract SMS codes, bank card details, or device control, escalating to threats and blackmail when initial tactics fail. Kaspersky Lab recorded over 19 million attempts to distribute malware disguised as popular games between April 2024 and April 2025, installing spyware and RAT trojans that monitor chats, keystrokes, cameras, and microphones. In severe cases, children are manipulated into believing they assist law enforcement, leading to real-world crimes such as photographing apartments, handing over keys, setting fires, or attacking people. Specific incidents include a 12-year-old boy from Leningrad Oblast forced to assault a police officer and a 13-year-old from Podolsk ordered to ignite a gas pump at a filling station. Izvestia reporting highlights that parents should watch for signs like hidden screens or strange tasks and teach children that no stranger can demand codes, money, or secret missions.

AntiMalwareTranslated from Russian

Read at source

Cybercriminals are increasingly viewing children not merely as gateways to their parents' finances but as direct perpetrators of high-risk operations. During extended school breaks, teenagers spend significantly more time immersed in online games and messaging apps, where fraudsters infiltrate with offers of free in-game currency, custom mods, cheats, and cracked game versions.

After establishing initial trust, attackers pressure young users to share SMS verification codes, banking card information, or grant remote access to a parent's smartphone. When persuasion fails, the criminals escalate to intimidation and blackmail using previously obtained personal data.

According to Kaspersky Lab, more than 19 million attempts to spread malicious and unwanted files disguised as popular games were detected from April 2024 to April 2025. These files install spyware and RAT trojans capable of reading private conversations, logging keystrokes, and secretly controlling cameras and microphones.

The danger intensifies when children use a parent's device containing corporate email and business applications, potentially exposing entire organizations to compromise through a single downloaded cheat.

Beyond account theft, adolescents are deceived into thinking they are assisting law enforcement agencies. Criminals threaten the arrest of parents or leverage compromising material to coerce compliance, ultimately demanding that children photograph their homes, surrender keys, set fire to property, or physically attack individuals.

In July, a 12-year-old boy from Leningrad Oblast was forced to assault a police officer, while a 13-year-old from Podolsk was ordered to ignite a gas column at a filling station.

Warning signs include a child suddenly hiding their screen, deleting chat histories, becoming anxious after calls, experiencing sleep disturbances, or receiving unusual instructions. Punishment only strengthens the criminal's hold, as the teenager becomes even more reluctant to confess.

Parents and guardians must reinforce that no unknown contact has the right to request codes, funds, documents, or secret assignments. Any such interaction should be immediately terminated, the conversation preserved, and shown to adults. Genuine law enforcement never recruits minors through gaming chats, as noted in reporting by Izvestia.

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Fraud & Social Engineering

Scammers Use *#62# USSD Command to Fabricate Surveillance Claims and Steal Victims' Funds
Aroshka Cloud Faces Scrutiny Over Alleged False Claims of SOC 24/7 Operations and High-End Infrastructure
Reports Surface on Alleged De-Anonymization of Admins Running Major Russian Hacker Forums