Microsoft accuses Chinese 'gaming site' of hacking Xbox accounts and selling proceeds on the open market

Microsoft has accused a Chinese gaming website of hacking Xbox accounts, using stolen payment card data to purchase rare items and selling the proceeds on the open market. In a complaint filed in the US District Court in the Northern District of California on Friday (19 May), Microsoft alleges that gaming website iGSKY has been "reaping millions of dollars in illicit profits from their illegal enterprise" since at least July 2015.

IGSKY offers players the opportunity to buy cheap in-game credits and rare items for various games including Fifa titles, Grand Theft Auto 5, Pokémon Go, Madden NFL games , Forza Hoizon 3 and Final Fantasy 14.

Microsoft claims the site used stolen credentials to infiltrate Microsoft accounts, hijack them by changing their credentials and used the linked payment cards to purchase gaming currencies and rare items. The site then sold access to these compromised accounts along with the fraudulently obtained in-game credits via iGSKY, the company alleged.

From December 2016 to January 2017, Microsoft's investigators successfully made six test purchases of Xbox accounts with in-game credits. In one test purchase described by investigator Jeremy Beckley, Microsoft's team purchased 11,000 Fifa points via iGSKY and paid $59.79 (£46.04) to parent company Gameest through PayPal.

The listed price for 12,000 Fifa points from Microsoft directly is $99.99.

Microsoft's team received an email and password change for an eight-year-old Xbox account that was created in October 2008. It also included a warning to spend the points "as soon as possible".

The account-holder's linked credit card was used to purchase Fifa 17 Deluxe Edition (which comes with 3,000 Fifa points) and Fifa 17 Super Deluxe Edition (8,000 Fifa points) for $127.54. The account's linked email address and password was also changed to include a new email address from the free Chinese email service 163.com.

Later, Microsoft customer service received a call from the account's original owner saying he could not access his account and that unauthorised charges were made to his credit card.

IGSKY has allegedly made nearly $2m in fraudulent purchases through these compromised accounts and linked customer cards.

Microsoft has brought charges of fraud, Computer Fraud and Abuse Act (CFAA) violations, trademark infringement, unjust enrichment and racketeering against Gameest and alleged operator Weiwei Chu.

"Microsoft is committed to providing customers with safe and secure online experiences," a Microsoft spokesperson told IBTimes UK. "We filed these lawsuits to protect our Xbox customers from the illegal trafficking of stolen property."

The judge presiding over the case has granted a temporary restraining order on Gameest freezing the company's domestic assets as well as any associated PayPal accounts. Further arguments in the case are scheduled for next week, The Verge reports.