Hackers Exploit StarCraft II Vulnerability to Show Disturbing Videos

Players are reporting that a vulnerability in StarCraft II allows hackers to inject videos into multiplayer matches and display them to other players without warning. Users have complained about seeing footage of real murders, Nazi symbols, and videos with rapidly flashing lights that could trigger seizures in people with photosensitive epilepsy.

“We loaded into a game with several regulars and a few randoms I didn’t know,” shared Reddit user Tad0422, who witnessed one of these videos. “About three minutes in, a video appeared on my screen. I’d never seen anything like it before—it took up the whole screen. It was a Russian pop music video or something similar, lasting about 20 seconds. Most of us were chatting, trying to figure out what was happening.

Then, about a minute later, a video showed a guy entering a store, with the StarCraft user interface and ghost voice lines overlaid. I was talking to other players, trying to understand what was going on. Then I realized he was killing people and shooting them in the head. At that point, I got scared and closed StarCraft II. My five-year-old daughter was in the room, partly paying attention to what I was playing.”

After Tad0422’s post, other players also began sharing on Reddit that they had encountered similar situations in StarCraft II over the past year. In the same thread, one user reported seeing an “epileptic screamer” in the game. Several others on the official StarCraft II forums and Reddit said they had been shown videos with Nazi symbols.

There are also posts on Reddit and the forums from about a year ago mentioning that some Arcade mode maps can completely crash the game client.

According to 404Media, which spoke directly with Tad0422, the player has already notified Blizzard representatives about the issue and filed complaints with the Entertainment Software Rating Board and the Federal Communications Commission. “I’m not trying to punish anyone, I just want the situation fixed,” Tad0422 explained.

Based on player reports from the past year, many believe the problem isn’t tied to a specific Arcade map, but rather to how the game processes lobby names. In Arcade mode, players can give lobbies any name, and it appears this field is being used to execute code that loads images, videos, or crashes the game.

Blizzard representatives told journalists that they are aware of the issue and are working on a fix.