Industry News
MMO game Street Mobster leaking data of 1.9 million users due to critical vulnerability
Attackers could exploit the SQL Injection flaw to compromise the game’s database and steal user data.
The CyberNews.com Investigation team discovered a critical vulnerability in Street Mobster, a browser-based massively multiplayer online game created by Bulgarian development company BigMage Studios.
Street Mobster is a free to play, browser-based online game in the mafia empire genre where players manage a fictional criminal enterprise. The game boasts a 1.9+ million player base and stores a user record database that can be accessed by threat actors by committing an SQL Injection (SQLi) attack on the game’s website.
Other games created by BigMage Studios are also potentially vulnerable to the same type of attack, which means that there is a possibility that even more users might be at risk.
The records that can be compromised by exploiting the SQLi vulnerability in Street Mobster potentially include the players’ usernames, email addresses, and passwords, as well as other game-related data that is stored on the database.
Fortunately, after we reported the vulnerability to BigMage Studios, CERT Bulgaria, and the Bulgarian data protection authority, the issue has been fixed by the developers and the user database is no longer accessible to potential attackers.
What is SQL Injection?
First found back in 1998, SQLi is deemed by the Open Web Application Security Project (OWASP) as the number one web application security risk.
Even though this vulnerability is relatively easy to fix, researchers found that 8% of websites and web applications are still vulnerable to SQLi attacks in 2020. Which, from a security perspective, is inexcusable. So much so, in fact, that UK internet service provider TalkTalk was hit with a record £400,000 fine over succumbing to a cyberattack that involved SQLi.
The vulnerability works by injecting an unexpected payload (a piece of code) into the input box on the website or in its URL address. Instead of reading the text as part of the URL, the website’s server reads the attacker’s payload as code and then proceeds to execute the attacker’s command or output data that would otherwise be inaccessible to unauthorized parties. Attackers can exploit SQLi even further by uploading pieces of code or even malware to the vulnerable server.
The fact that Street Mobster is susceptible to SQLi attacks clearly shows the disappointing and dangerous neglect of basic security practices on the part of the developers at BigMage Studios.
How we found this vulnerability
Our security team identified an SQL Injection vulnerability on the Street Mobster website and were able to confirm the vulnerability by performing a simple command injection test on the website URL. The CyberNews team did not extract any data from the vulnerable Street Mobster database.
What’s the impact of the vulnerability?
The data in the vulnerable Street Mobster database can be used in a variety of ways against the players whose information was exposed:
By injecting malicious payloads on Street Mobster’s server, attackers can potentially gain access to said server, where they can install malware on the game’s website and cause harm to the visitors – from using the players’ devices to mine cryptocurrency to redirecting them to other malicious websites, installing malware, and more.
The 1.9 million user credentials stored on the database can net the attackers user email addresses and passwords, which they can potentially use for credential stuffing attacks to hack the players’ accounts on other gaming platforms like Steam or other online services.
Because Street Mobster is a free-to-play game that incorporates microtransactions, bad actors could also make a lot of money from selling hacked player accounts on gray market websites.
What to do if you’ve been affected?
If you have a Street Mobster account, make sure to change your password immediately and make it as complex as possible. If you’ve been using your Street Mobster password on any other websites or services, change that password as well. This will prevent potential attackers from accessing your accounts on these websites in case they try to reuse your password for credential stuffing attacks.
However, it’s ultimately up to BigMage Studios to completely secure your Street Mobster account against attacks like SQLi.
Disclosure and lack of communication from BigMage Studios
Following our vulnerability disclosure guidelines, we notified the BigMage Studios about the leak on August 31, 2020. However, we received no reply. Our follow-up emails were left unanswered as well.
We then reached out to CERT Bulgaria on September 11 in order to help secure the website. CERT contacted the BigMage Studios and informed the company about the misconfiguration.
Throughout the disclosure process, BigMage Studios stayed radio silent and refused to get in touch with CyberNews.com. Due to this reason, we also notified the Bulgarian data protection agency about the incident on October 9 in the hopes that the agency would be able to pressure the company into fixing the issue.
Eventually, however, BigMage Studios appear to have fixed the SLQi vulnerability on streetmobster.com, without informing either CyberNews.com or CERT Bulgaria about that fact.
Powered by WPeMatico
Gaming
Soft2Bet launches MEGA Islands, a new gamification engine designed to increase player retention
Soft2Bet has unveiled MEGA Islands, the latest addition to its MEGA Suite, designed to enhance player engagement and retention across both casino and sportsbook offerings.
The new engine introduces a persistent progression system that carries over across sessions, giving players an ongoing reason to return. Through island-building, resource collection, and continual advancement, players embark on a long-term journey that transforms short play sessions into sustained engagement.
First previewed in Soft2Bet’s recent Lodur release, the MEGA Islands system allows players to develop their own islands over time. Resources earned through gameplay can be used to construct new buildings, upgrade existing structures, and unlock further stages of progression. Each upgrade opens new goals, creating a loop of continuous advancement that keeps players invested.
The engine also incorporates plundering mechanics, giving players an additional path to gather resources by raiding other islands. This feature not only accelerates growth but also maintains a dynamic and engaging progression loop. With no fixed endpoint, MEGA Islands is built to encourage repeat play through a satisfying cycle of building, collecting, and advancing.
“MEGA Islands is designed to make retention feel natural by providing players with a progression journey they want to return to,” said Yoel Zuckerberg, CPO at Soft2Bet. “By building islands, collecting resources, and unlocking upgrades—including through plundering—each session becomes part of a longer experience. It gives players a clear reason to come back while providing operators with a retention tool that integrates seamlessly across casino and sportsbook.”
The launch of MEGA Islands underscores Soft2Bet’s commitment to gamification as a driver of long-term growth. As part of the MEGA Suite, the new engine offers operators a powerful tool to extend player journeys, increase engagement cycles, and deliver consistent value in competitive markets.
The post Soft2Bet launches MEGA Islands, a new gamification engine designed to increase player retention appeared first on Eastern European Gaming | Global iGaming & Tech Intelligence Hub.
GR8 Tech CEO Oleksandr Feshchenko has been named Global CEO of the Year 2026 in the Technology Industry by European CEO magazine—the second consecutive year he has received the honour. The judging panel’s decision was unanimous.
The award recognised Feshchenko’s leadership across three areas the panel identified as defining:
• Track record of turning technological strategy into scalable commercial outcomes;
• Focus on building an organization designed to last, not just perform;
• Consistent investment in people and culture as core business levers rather than afterthoughts.
What distinguished Feshchenko from a competitive field, according to the panel, was the combination of all three. Individual strengths are common at the CEO level, but the consistency across strategy, execution and organisational health is rare.
Under Oleksandr Feshchenko’s leadership, GR8 Tech has grown into a recognised provider of technology solutions for the iGaming sector, with an approach that the panel described as forward-looking without sacrificing operational discipline.
“Receiving this recognition two years in a row means a great deal, but if there’s one thing I’ve learned, it’s that success is most dangerous when it makes you comfortable. This award belongs to the team at GR8 Tech as much as it does to me, and what it really does is raise the bar. The technology industry doesn’t stand still, and neither do we. There’s a lot we’re building toward, and that’s exactly where our focus stays,” Oleksandr Feshenko said.
The Global CEO of the Year award is presented annually by European CEO magazine following an evaluation of international candidates across various industries.
The post GR8 Tech CEO Named CEO of the Year for Second Consecutive Year appeared first on Eastern European Gaming | Global iGaming & Tech Intelligence Hub.
Augmented Reality
XR Global Launches World’s First Augmented Reality Online Casino Games Across iOS, Android and Immersive Web
XR Global Inc, the first Extended Reality (XR) technologies casino games developer with Patent Pending Technology on its Cross-XR Platform, announced the official launch of the world’s first Augmented Reality (AR) online casino games available across iOS, Android and the Immersive Web. This groundbreaking milestone positions XR Global at the forefront of innovation in the global iGaming industry, delivering a next-generation gaming experience that goes far beyond traditional 2D online casino platforms.
By leveraging cutting-edge Extended Reality (XR) technologies—including Augmented Reality (AR), Mixed Reality (MR), Virtual Reality (VR) and 3D immersive environments—XR Global enables players to step into fully interactive casino worlds from their mobile devices or web browsers, without the need for specialised hardware.
Unlike conventional online casino games confined to flat, 2D interfaces, XR Global’s platform allows users to engage with games such as slots, roulette, blackjack and crash games in a real-world environment. Players can place games on their tables, walk around them, interact with live elements and experience a level of realism and immersion previously only possible in physical casinos or high-end VR setups.
“XR Global is redefining what online gaming looks and feels like. We are bridging the gap between physical and digital entertainment by bringing casino experiences into players’ real-world environments. This is not just an evolution—it’s a transformation of the entire gaming paradigm,” said Dan Martinez, Founder & CEO of XR Global.
The launch marks a significant leap forward for player engagement, retention and monetisation. XR Global’s immersive experiences are designed to increase session times, deepen emotional connection and create highly differentiated offerings for operators in an increasingly competitive market.
The company plans to license its XR-enabled gaming portfolio globally, enabling partners to integrate immersive gaming into their existing platforms and attract a new generation of players seeking more interactive and engaging experiences.
The post XR Global Launches World’s First Augmented Reality Online Casino Games Across iOS, Android and Immersive Web appeared first on Eastern European Gaming | Global iGaming & Tech Intelligence Hub.
-
Alberta6 days agoMedia Troopers Prepares for Alberta iGaming Launch with Canadian Gaming Law Firm
-
40 Sparkling Crown6 days ago
TaDa Gaming Enters South Africa via Strategic Betway Partnership
-
Asia5 days ago
GLI Becomes the First Company Accredited by PAGCOR to Test and Certify iGaming Platforms in the Philippines
-
Bettingbladet.se6 days ago
Bettingbladet Aims to Become Sweden’s Central Hub for Gambling Industry News & Trends
-
Barbie Nerz Head of Online Games at Staatliche Toto-Lotto GmbH Baden-Württemberg6 days ago
Peter & Sons Partners with Staatliche Toto-Lotto GmbH Baden-Württemberg for German Market Entry
-
ADM6 days ago
ENJOY gains Italian approval amid advancing regulated expansion strategy
-
Games Global6 days ago
Games Global and Just For The Win® continue the ghostly adventure in Dark Waters III Power Combo: The Cursed Voyage™
-
Bragg Gaming Group6 days ago
Bragg Gaming Group Reports Record Fourth Quarter and Full Year 2025 Revenues
