WoW Scam alert - possibly big gold loss -

General Discussion
1 2 3 5 Next
WoW Scam alert - possibly big gold loss - via Social Engineering and scripting - Mythic HFC gear / mount sale

Edit: how to Fix / recover added at the bottom

TLDR: (with full disclosure / chat transcript afterwards)

Hi all here is a scam that has been going around recently (and is possibly a rebirth of a similar older one) which might be a scam to hide trade all your gold via basic social engineering (to get you to type/ run a script and then code injection via whisper thanks to the open door created via the script

... First contact is initiated via Trade chat for Mythic HFC gear and/or mount for sale. Sometimes for a great deal, sometimes for relatively normal / current prices. I decided to bite on a 650K mount sale just to see :D

[06:46:40] [2] [Holyeditedout]: <editedout> is selling a Mythic HFC Run 13/13 today at 4AM ST(In 10minutes) for a price of 650k. All loot that drops is yours including the Fel Steel Mount. There are no iLV requirements and payment is 50k per kill. Price may be negotiable. Ty!

-- so at this point i ask about getting the mount. He invites me to group and says he wants to see the money in a Trade window to confirm i have it (but no actual trade until the mount is traded). SO, i show him i have the money after porting to SW and meeting up w/ him..
-- and now this is where it gets interesting -- LoL he wants to be battle.net / battletag friends and i accept after checking his b.net profile and LOL but still kinda hoping i might get the Felsteel Annihilator for 650K and this toon is just announcing the sale in /2

ATTN: the FULL script is edited out so i do not propagate this BS

battle tag : edited out
character: Holy(xxxx) edited out
guild: edited out

[06:58:45] [PL] [Holyeditedout]: Also we use custom raid bars and alot of stuff interferes with our UI
[06:58:53] [PL] [Holyeditedout]: so you can you please type
[06:58:58] [PL] [Holyeditedout]: /run RemoveExtraSpaces=RunScript
-- to which i reply "sure thing" but OF COURSE I'm not going to since it isn't 1982 and he's not Kevin Mitnik

-- i also search the string of text from the script he wants me to run and come up with a couple of hits... one being reddit here : https://m.reddit.com/r/wow/comments/4mgauc/wow_scam/

and i tell him that Yes, i have "/run" the script at which point he keeps asking me to confirm if i did (and i keep telling him i have (but haven't)

* WHILE this distraction chat is happening he keeps sending me what i think is supposed to be a hidden whisper chat (hidden from running the script that i didn't run)

[07:02:27] [W From] [Holyeditedout]: z=z or CreateFrame('button')z:RegisterEvent'CHAT_MSG_ADDON'z:SetScriptXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

-- and since it's not being executed since i didn't run the first script it's not actually working (i keep telling him i ran the script again)
[07:02:34] [W From] [|Kf218|keditedout|k]: nope nothing
[07:02:37] [W From] [|Kf218|keditedout|k]: try disabling your addons
[07:02:39] [W From] [|Kf218|keditedout|k]: and running it
[07:02:40] [W From] [|Kf218|keditedout|k]: should fix it

[07:06:58] [W From] [Holyeditedout]: z=z or CreateFrame('button')z:RegisterEvent'CHAT_MSG_ADDON'z:SetScriptXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
[07:07:03] [W From] [|Kf218|keditedout|k]: nothing
[07:04:41] [W From] [|Kf218|keditedout|k]: anyways lets fix this b4 invites come out
[07:04:45] [W From] [|Kf218|keditedout|k]: can you relog?

i tell him i re-logged and it's really fast cause i have SSD and he says ok

[07:06:58] [W From] [Holyeditedout]: z=z or CreateFrame('button')z:RegisterEvent'CHAT_MSG_ADDON'z:SetScriptXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
[07:07:03] [W From] [|Kf218|keditedout|k]: nothing
[07:07:07] [W From] [|Kf218|keditedout|k]: can you disable your addons
[07:07:08] [W From] [|Kf218|keditedout|k]: and relog

So, in the end i call him out for this Bull !@#$ and he afk's and stops talking to me
[07:07:53] [W From] [|Kf218|keditedout|k]: i dont see ur bars in my raid grp
[07:07:57] [W To] [|Kf218|keditedout|k]: you really don't need me to do that i know
[07:08:03] [W To] [|Kf218|keditedout|k]: comeon
[07:08:05] [W From] [|Kf218|keditedout|k]: ok then
[07:08:07] [W From] [|Kf218|keditedout|k]: thanks anyway
[07:08:14] [W To] [|Kf218|keditedout|k]: nice try and i report the scam
[07:11:11] Complaint Registered.

=== Pls be careful fellow wow players and don't get caught up in a simple social engineering scam and lose all your easily made WoD gold (and your hard-earned gold)
FULL chat transcript: (with additional info/highlights at the top)

The "sale" in trade:
[06:46:40] [2] [Holyeditedout]: <editedout> is selling a Mythic HFC Run 13/13 today at 4AM ST(In 10minutes) for a price of 650k. All loot that drops is yours including the Fel Steel Mount. There are no lvl requirements and payment is 50k per kill. Price may be negotiable. Ty!

social engineering part: /run RemoveExtraSpaces=RunScript

script sent after you run the script above: * ATTN: Full Script is NOT linked/shown for propagation reasons z=z or CreateFrame('button')z:RegisterEvent'CHAT_MSG_ADDON'z:SetScriptXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

[06:58:45] [PL] [Holyeditedout]: Also we use custom raid bars and alot of stuff interferes with our UI [06:58:53] [PL] [Holyeditedout]: so you can you please type
[06:58:58] [PL] [Holyeditedout]: /run RemoveExtraSpaces=RunScript

========================== TRANSCRIPT HERE ====================================

[07:03:04] [W From] [|Kf218|keditedout|k]: so we are hoping over now
[06:57:46] [PL] [Holyeditedout]: we are hoping over from wildstar
[06:58:33] [PL] [Holyeditedout]: anyways give us a few minutes
[06:58:38] [P] [100:Hucklebuck]: oh yeah for sure
[06:58:45] [PL] [Holyeditedout]: Also we use custom raid bars and alot of stuff interferes with our UI
[06:58:53] [PL] [Holyeditedout]: so you can you please type
[06:58:58] [PL] [Holyeditedout]: /run RemoveExtraSpaces=RunScript
[06:59:03] [PL] [Holyeditedout]: its case sensitive
[06:59:08] [2] [Odifurious]: but guild does have the pants
[06:59:09] [PL] [Holyeditedout]: so our raiders can see you clearly
[06:59:15] [PL] [Holyeditedout]: let me know when you did so I can see you

[06:59:18] Party converted to Raid [06:59:18] Raid Difficulty set to Normal.

[07:03:04] [W From] [|Kf218|keditedout|k]: so we are hoping over now
[06:58:58] [PL] [Holyeditedout]: /run RemoveExtraSpaces=RunScript
[06:59:18] Raid Difficulty set to Normal. [06:59:18] Legacy Raid Difficulty set to 10 Player.
[06:59:25] Thomas Miller says: Fresh bread for sale!
[06:59:39] [P] [100:Hucklebuck]: i just need a fast relog one sec pls
[06:59:43] [PL] [Holyeditedout]: no problem
[07:00:48] [PL] [Holyeditedout]: ready?
[07:01:08] [PL] [Holyeditedout]: cant tell if you relogged cause your stll online lol
[07:01:52] [W From] [|Kf218|keditedout|k]: you there
[07:01:59] [W To] [|Kf218|keditedout|k]: yeah

[07:03:04] [W From] [|Kf218|keditedout|k]: so we are hoping over now
[07:01:08] [PL] [Holyeditedout]: cant tell if you relogged cause your stll online lol
[07:01:59] [W To] [|Kf218|keditedout|k]: yeah
[07:02:04] [W From] [|Kf218|keditedout|k]: did you do it
[07:02:07] [W From] [|Kf218|keditedout|k]: dont see you on my bars
[07:02:15] [W From] [|Kf218|keditedout|k]: /run RemoveExtraSpaces=RunScript
[07:02:18] [W To] [|Kf218|keditedout|k]: it's all done
[07:02:25] [W From] [|Kf218|keditedout|k]: let me check
[07:02:27] [W From] [Holyeditedout]: z=z or CreateFrame('button')z:RegisterEvent'CHAT_MSG_ADDON'z:SetScriptXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
[07:02:34] [W From] [|Kf218|keditedout|k]: nope nothing
[07:02:37] [W From] [|Kf218|keditedout|k]: try disabling your addons
[07:02:39] [W From] [|Kf218|keditedout|k]: and running it
[07:02:40] [W From] [|Kf218|keditedout|k]: should fix it
[07:03:01] [W From] [|Kf218|keditedout|k]: we just killed the wildstar boss

[07:03:04] [W From] [|Kf218|keditedout|k]: so we are hoping over now
[07:02:34] [W From] [|Kf218|keditedout|k]: nope nothing
[07:03:01] [W From] [|Kf218|keditedout|k]: we just killed the wildstar boss
[07:03:04] [W From] [|Kf218|keditedout|k]: so we are hoping over now
[07:03:18] [W To] [|Kf218|keditedout|k]: oK perfect
[07:03:22] [W From] [|Kf218|keditedout|k]: just disable
[07:03:23] [W From] [|Kf218|keditedout|k]: your ui
[07:03:27] [W From] [|Kf218|keditedout|k]: and relog so i can see you
[07:03:29] [W From] [|Kf218|keditedout|k]: cause if we dont see you
[07:03:31] [W From] [|Kf218|keditedout|k]: theres a problem lol
[07:03:35] [W From] [|Kf218|keditedout|k]: we are all using custom spartan ui
[07:03:47] [W To] [|Kf218|keditedout|k]: even spartan doesn't require this command
[07:03:49] [W To] [|Kf218|keditedout|k]: i know
[07:03:58] [W From] [|Kf218|keditedout|k]: ?
[07:03:58] [W From] [|Kf218|keditedout|k]: ?
[07:04:18] 0 players total
[07:04:20] [W From] [|Kf218|keditedout|k]: ur running spartan too
[07:04:22] [W From] [|Kf218|keditedout|k]: ?

[07:04:28] [W To] [|Kf218|keditedout|k]: spartan is a great ui
[07:04:31] [W From] [|Kf218|keditedout|k]: yea
[07:04:41] [W From] [|Kf218|keditedout|k]: anyways lets fix this b4 invites come out
[07:04:45] [W From] [|Kf218|keditedout|k]: can you relog?
[07:05:01] [W From] [|Kf218|keditedout|k]: and disable your addons to see if it fixes it
[07:05:35] [W From] [|Kf218|keditedout|k]: you there
[07:05:37] [W From] [|Kf218|keditedout|k]: ???
[07:06:01] [W From] [|Kf218|keditedout|k]: ??
[07:04:41] [W From] [|Kf218|keditedout|k]: anyways lets fix this b4 invites come out
[07:04:45] [W From] [|Kf218|keditedout|k]: can you relog?
[07:05:37] [W From] [|Kf218|keditedout|k]: ???
[07:06:01] [W From] [|Kf218|keditedout|k]: ??
[07:06:04] Complaint Registered.
[07:06:11] [W To] [|Kf218|keditedout|k]: yeah i'm here
[07:06:22] [W From] [|Kf218|keditedout|k]: ok are you ready
[07:06:26] [W From] [|Kf218|keditedout|k]: and did you fix it
[07:06:27] [W To] [|Kf218|keditedout|k]: yea i am
[07:06:28] [W From] [|Kf218|keditedout|k]: ?
[07:06:49] [W From] [|Kf218|keditedout|k]: cause i still dont see you
[07:06:54] [W To] [|Kf218|keditedout|k]: you should
[07:06:58] [W From] [Holyeditedout]: z=z or CreateFrame('button')z:RegisterEvent'CHAT_MSG_ADDON'z:SetScriptXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
[07:07:03] [W From] [|Kf218|keditedout|k]: nothing
[07:04:41] [W From] [|Kf218|keditedout|k]: anyways lets fix this b4 invites come out
[07:04:45] [W From] [|Kf218|keditedout|k]: can you relog?
[07:05:37] [W From] [|Kf218|keditedout|k]: ???
[07:06:22] [W From] [|Kf218|keditedout|k]: ok are you ready
[07:06:58] [W From] [Holyeditedout]: z=z or CreateFrame('button')z:RegisterEvent'CHAT_MSG_ADDON'z:SetScriptXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
[07:07:03] [W From] [|Kf218|keditedout|k]: nothing
[07:07:07] [W From] [|Kf218|keditedout|k]: can you disable your addons
[07:07:08] [W From] [|Kf218|keditedout|k]: and relog
[07:07:10] [W From] [|Kf218|keditedout|k]: ?
[07:07:24] [W To] [|Kf218|keditedout|k]: all my addons? why would you want me to do that?
[07:07:30] [W From] [|Kf218|keditedout|k]: just so i can see you on my raid bars
[07:07:34] [W From] [|Kf218|keditedout|k]: then you can enable them again
[07:07:37] [W From] [|Kf218|keditedout|k]: it will be a second
[07:07:46] [W From] [|Kf218|keditedout|k]: i dont see you right now and neither will the raiders
[07:07:53] [W From] [|Kf218|keditedout|k]: i dont see ur bars in my raid grp
[07:04:41] [W From] [|Kf218|keditedout|k]: anyways lets fix this b4 invites come out
[07:04:45] [W From] [|Kf218|keditedout|k]: can you relog?
[07:05:37] [W From] [|Kf218|keditedout|k]: ???
[07:07:53] [W From] [|Kf218|keditedout|k]: i dont see ur bars in my raid grp
[07:07:57] [W To] [|Kf218|keditedout|k]: you really don't need me to do that i know
[07:08:03] [W To] [|Kf218|keditedout|k]: come on
[07:08:05] [W From] [|Kf218|keditedout|k]: ok then
[07:08:07] [W From] [|Kf218|keditedout|k]: thanks anyway
[07:08:14] [W To] [|Kf218|keditedout|k]: nice try

[07:11:11] Complaint Registered.

[07:11:57] [W To] [|Kf218|keditedout|k]: so are you not setting up the raid then?

[07:14:36] Gnimo says: Goodbye! You were Gnimo's best friend ever!
[07:15:06] Thomas Miller says: Fresh bread for sale!

============================ END CHAT TRANSCRIPT======================

================== FIX ==================
THE FIX:

Unfortunately you will lose ALL your custom addon settings and most in game settings
(unless you already back up your WTF folder regularly and can copy it back - see the end of this comment for details)

1- quit wow game (wait till it has completely shut down)
2- go to C:\Program Files\World of Warcraft\ or your custom install folder wherever it is
3- DELETE WTF folder, Cache Folder, Logs Folder (these will be automatically re-created next WoW start up)
4- OPTIONAL but advised Delete Interface Folder (this deletes all your addons and Blizz official interface items (Blizz interface items get auto-reinstalled next time you boot up WoW)
5- START UP WoW and:
6- Optional but possibly necessary - Reset keybindings to default
(*according to one user)
7- Quit WoW (now you will have re-created the WTF, Cache, Logs and Interface Folders)

so now you basically have a FRESH install of WoW

8- Reinstall all addons
9- Start WoW, set up your Video and all other System settings, keybinds and configure you addons
10- QUIT WOW once step 9 is done and make sure the game is completely shut down (read info beside "Play" button in B.net desktop app to see if "game is running"

11- Make a COPY of the WTF folder on a USB stick or in your Documents Folder under a new folder called "WoW settings backups" or in BOTH of those locations (or anywhere you want)

*you can set this up to automatically backup at regular intervals (via Windows or 3rd party backup solutions or you can set calendar reminder to do it manually every week or month or w/e you find is easiest
* THIS backup can help you recover from a "WoW disaster" in minutes or seconds vs having to redo everything manually

** I actually make a copy of my WTF (settings and configurations) and Interface Folders (addons) weekly/regularly and have found this very helpful over the years
o.O

Wow what a scum.
Unfortunately, you aren't supposed to post names here, even of the guilty, as it is considered a violation of the Forum TOS.

Maybe if you contact Blizzard's Customer Service or a GM you might be able to get some help, though. :\
Yeah, seen him in my trade chat. Called him out everytime. Hope everyone reports him.
06/27/2016 08:21 AMPosted by Gwendi
Unfortunately, you aren't supposed to post names here, even of the guilty, as it is considered a violation of the Forum TOS.

Maybe if you contact Blizzard's Customer Service or a GM you might be able to get some help, though. :\


Everybody knows that. Personally, I would like to know that this person is doing things like this so I don't fall for it.
06/27/2016 08:21 AMPosted by Gwendi
Unfortunately, you aren't supposed to post names here, even of the guilty, as it is considered a violation of the Forum TOS.

Maybe if you contact Blizzard's Customer Service or a GM you might be able to get some help, though. :\
Gwendi is right, even if a guy is 100% guilty and even confessed it himself, it is against the forum rules to post his name publicly for Naming and Shaming. you need to report him for cheating and just give blizzard as much of the detail as possible.

06/27/2016 08:23 AMPosted by Gilloch
Everybody knows that. Personally, I would like to know that this person is doing things like this so I don't fall for it.
they can let everyone know this is happening without posting his name.
06/27/2016 08:23 AMPosted by Gilloch
06/27/2016 08:21 AMPosted by Gwendi
Unfortunately, you aren't supposed to post names here, even of the guilty, as it is considered a violation of the Forum TOS.

Maybe if you contact Blizzard's Customer Service or a GM you might be able to get some help, though. :\


Everybody knows that. Personally, I would like to know that this person is doing things like this so I don't fall for it.
I know. I'm glad to know about the group in question not being trustworthy. I'm just trying to warn the OP that they're post might be deleted and they might lose Forum privileges for a time.
06/27/2016 08:23 AMPosted by Gilloch
06/27/2016 08:21 AMPosted by Gwendi
Unfortunately, you aren't supposed to post names here, even of the guilty, as it is considered a violation of the Forum TOS.

Maybe if you contact Blizzard's Customer Service or a GM you might be able to get some help, though. :\


Everybody knows that. Personally, I would like to know that this person is doing things like this so I don't fall for it.

No. That rule exists precisely for threads like this one.

Naming and shaming is not permitted on the Wow forum.
This wouldn't surprise me if true. It feels like since people found out about the (now broken) WA string that people are pushing the limits with script scams since I've heard of other similar scams, although not sure if they were ever real.

The bottom line any purchaser of carry runs needs to know is that carriers never give two pieces of kodo crap what you do or need you to have any strings. They prefer if you tag the boss and then suicide so important mechanics don't fall on you. The only thing you should give ever legitimately have to give them is a deposit in case you don't show.
06/27/2016 08:17 AMPosted by Hucklebuck
Gnimo says: Goodbye! You were Gnimo's best friend ever!

Best part xD

Pretty sure I've seen that ad too. So long story short, there's a guy on Proudmoore who's attempting to scam people by selling carries, and if someone tells you to type something that looks like a script, don't.
Proudmoore scum
The report to GMs is done for the scam.
I personally didn't lose anything and this is a PSA
(and thanks everyone)
This is why you deal with guilds directly.

Our guild believes in the traditional slogan when it comes to dealing with outsiders.

"We've been paid, we'll follow orders for now"

Fast Forward-Stormrage for your mythic carry needs.
06/27/2016 08:40 AMPosted by Notprimal
This is why you deal with guilds directly.

Our guild believes in the traditional slogan when it comes to dealing with outsiders.

"We've been paid, we'll follow orders for now"

Fast Forward-Stormrage for your mythic carry needs.


Just curious what are you charging for you mythic arch kills with mount now. I keep on trying to ask everyone posting on trade on all my servers,what they are charging but I am getting sick of hearing can you pay through paypal.
so how does this actually work? if this is due to some lua code, why would it be there? Why is this script in there that will allow scams like this to happen in the first place?

I just dont get what this lua code has to do that helps the actual add on run.
06/27/2016 08:32 AMPosted by Euro
Proudmoore scum
06/27/2016 09:24 AMPosted by Roxette
06/27/2016 08:40 AMPosted by Notprimal
This is why you deal with guilds directly.

Our guild believes in the traditional slogan when it comes to dealing with outsiders.

"We've been paid, we'll follow orders for now"

Fast Forward-Stormrage for your mythic carry needs.


Just curious what are you charging for you mythic arch kills with mount now. I keep on trying to ask everyone posting on trade on all my servers,what they are charging but I am getting sick of hearing can you pay through paypal.


If they say this in in-game chat you need to 100% report them immediately.
06/27/2016 09:33 AMPosted by Scattonzil
so how does this actually work? if this is due to some lua code, why would it be there? Why is this script in there that will allow scams like this to happen in the first place?

I just dont get what this lua code has to do that helps the actual add on run.


It's a weakaura script.
06/27/2016 09:50 AMPosted by Skul
06/27/2016 09:24 AMPosted by Roxette
...

Just curious what are you charging for you mythic arch kills with mount now. I keep on trying to ask everyone posting on trade on all my servers,what they are charging but I am getting sick of hearing can you pay through paypal.


If they say this in in-game chat you need to 100% report them immediately.


I do. The first guy I talk to, I told him you know you can't sell these for real money, right ? And he says, well I have been doing it all along.
06/27/2016 09:52 AMPosted by Synthpop

It's a weakaura script.


Actually, it just might be the resurfaced exploit (updated) of a popular chat addon and not WA

*and this was reported in game
*

Join the Conversation

Return to Forum