So apparently, there's this semi-popular 3D Avatar artist in Japan who recently started to give out strange .exe files for the customers to... execute in order to get their avatar that they **PAID** for?
When I first heard about this, it sounded like a straightup Discord scam; I thought that there's no way anyone would pay some random 3D Avatar Artists money **and then** runs their suspicious .exe file without questioning it.
... Oh how I was wrong...
So. If I'm hearing all [this](https://x.com/ouji_kun_v/status/1974816796206096604) dog-doo correctly, when you download the latest 3D Avatar [Pmma-chan](https://nem3.booth.pm/items/7062407) by [@nem_nem_nemri@x.com](https://x.com/nem_nem_nemri), you will **not** get an avatar file, but instead you get a 800+MiB of pure hot $[blur **malware**] **.EXE** that will:
1. Ask for your booth login credentials,
2. logs in to your personal booth account using YOUR Edge browser in YOUR computer, and downloads your purchased avatar for you and...
3. ...will start **scraping the hell out of everything it sees in your account from booth.pm**!?
Every single one of your past BOOTH purchases,
alongside all of it's related metadata, even the download links that shouldn't even be shared AT ALL...it will scrape all of that while running in **YOUR PC**'s background! and
4. **sends all that data log over to nem_nem_nemri(the author of Pmma-chan)'s personal backend server `pmmasoft-backend.nem2.net`.**
Oh, and the best part? This **.exe file will auto-start itself** EVERY TIME you turn on your PC from now on.
Was there any form of consent? → **NOPE.**
Was it in their privacy policy?
→ Honey, Pmma-chan **doesn't have** a privacy policy!
This is a straight up **illegal scraping spyware without user's consent** on it's highway to a lawsuit.
RN: https://misskey.niri.la/notes/adfxcd9f6h #PMMA3D
นาตาลี :bellsystem:
All GNU social JP content and data are available under the