{"id":93861,"date":"2019-01-17T17:00:35","date_gmt":"2019-01-18T01:00:35","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=93861"},"modified":"2025-08-30T02:47:54","modified_gmt":"2025-08-30T09:47:54","slug":"fortnite-flaw-phishing-accounts","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/internet-security\/fortnite-flaw-phishing-accounts\/","title":{"rendered":"Frequent Fortnite Player? 4 Tips to Combat the New Attack on User Accounts"},"content":{"rendered":"

Epic Games\u2019 Fortnite has risen in popularity rapidly since its debut, and cybercriminals have leveraged<\/a>\u00a0that popularity to enact a handful of malicious schemes<\/a>. Unfortunately, these tricks are showing no signs of slowing, as researchers recently discovered a security flaw<\/a>\u00a0that allowed cybercriminals to take over a gamer\u2019s Fortnite account through a malicious link. This attack specifically targeted users who used a third-party website to log in to their Fortnite accounts, such as Facebook, Google, or gaming providers like Microsoft, Nintendo, and Sony. But instead of trying to steal a gamer\u2019s password like many of the hacks we\u2019ve seen, this scheme targeted the special access token the third-party website exchanges with the game when a user logs in.<\/p>\n

So, how exactly does this threat work? First, a cybercriminal sends a malicious phishing link to a Fortnite user. To increase the likelihood that a user will click on the link, the cybercriminal would send the link with an enticing message promising perks like free game credits. If the user clicked on the link, they would be redirected to the vulnerable login page. From here, Epic Games would make the request for the SSO (single sign-on) token from the third-party site, given SSO allows a user to leverage one set of login credentials across multiple accounts. This authentication token is usually sent to Fortnite over the back-end, removing the need for the user to remember a password to access the game. However, due to the unsecured login page, the user would be redirected to the attacker\u2019s URL. This allows cybercriminals to intercept the user\u2019s login token and take over their Fortnite account.<\/p>\n

After acquiring a login token, a cybercriminal would gain access to a Fortnite user\u2019s personal and financial details. Because Fortnite accounts have partial payment card numbers tied to them, a cybercriminal would be able to make in-game purchases and rack up a slew of charges on the victim\u2019s card.<\/p>\n

Gaming Security Tips<\/h2>\n

It\u2019s important for players to understand the realities of gaming security in order to be more prepared for potential cyberthreats such as the Fortnite hack. According to McAfee research, the average gamer has experienced almost five cyberattacks, with 75% of PC gamers worried about the security of gaming. And while Epic Games has thankfully fixed this security flaw, there are a number of techniques players can use to help safeguard their gaming security now and in the future:<\/p>\n