With just one click, a streamer lost 30,000 gold in WoW Classic. The scammer exploited a vulnerability in the add-on “WeakAuras”.
In World of Warcraft Classic, 30,000 gold is a substantial amount of money. That’s enough for many epic mounts and should also amount to a nice sum for the launch of The Burning Crusade Classic. It’s all the more devastating to lose all that gold through a nasty trick. This happened to the streamer DragonauTV, who now stands without gold because he imported a weak aura from a scammer.
What are WeakAuras? WeakAuras is a useful and quite popular add-on that allows for a whole range of customizations. It is primarily used to display cooldowns and procs more prominently on the screen, allowing one to see everything important at a glance. However, the add-on is quite powerful and has many additional functions that the scammer exploited.
Different settings for WeakAuras can easily be shared with other players – this is quite normal in the community. Many therefore naively trust the code from other players without verifying it.
What happened? The streamer DragonauTV received a weak aura from one of his viewers. This was supposed to display useful information about a dungeon. Without checking what it involved, DragonauTV imported the code and loaded it into his game.
Then the scammer asked him to quickly go to the mailbox, as he wanted to send the streamer a small gift. DragonauTV thought nothing of it, went over to the mailbox, and clicked on it.
It was right here that the scammer struck: the imported weak aura exploited a vulnerability and caused the streamer to automatically send all his gold – almost 30,000 – to the scammer. Within 2 seconds, the gold was gone and the scammer was offline with his loot.
How was this possible? In principle, mail functions in WeakAuras are blocked, but the scammer exploited a loophole in the code to achieve this anyway. The developers of the add-on have already been notified and have released a new version, which will soon be available in the major add-on databases.
So always pay attention to which add-ons you install or which codes you accept from strangers. Especially when using macros, one should always check what exactly the macro does or how an add-on works. If you’re not sure, then don’t install and use it – otherwise, such incidents can occur.
Have you ever fallen for a scammer? How would you have reacted in that situation?
Some classic streamers also carelessly spend their gold in the auction house – like in this example from Sodapoppin.
