Help! Some strange things are going on!

#0 - Oct. 28, 2010, 12:48 p.m.
Blizzard Post
So here's the deal. Around 10pm PST Wednesday night my WoW client crashed with an unknown error.
After that i tried to log back in like normal and normally where the authentication box would go it was blank. I was just messing around by that point and entering wrong passwords, and wrong authentication codes..

Immediately after that I receive an email saying my account was locked due to suspicious activity. I was worried a tiny bit that it was because I was getting hacked at that moment, but I was mainly thinking that it was because I put wrong passwords/authenticator numbers.. I spent a couple hours reinstalling/ downloading the patches and then tried to log back in and still got the same blank box.. Then I did a Google search about blank boxes while logging in, and saw a post over on these forums describing what to do if you have that error.

After I did that remedy, I logged into my account, and was horrified to see that most of my stuff in my bags were gone! :( At first I was thinking how can I get hacked with an authenticator... Then I was thinking that maybe it was because of the continuing streaming downloading.. So I log out and wait to re log after it was done completing, and was still horrified to see that the bags were mostly empty but my equipped gear was still on..

Can the GM's see if I was indeed hacked? I opened a ticket also but am expecting a long wait time. If I was hacked, i just can't believe that even with an authenticator I could still get hacked..
#2 - Oct. 28, 2010, 2 p.m.
Blizzard Post
Certainly appears this was the case, Psyk.

Sounds like you picked up a rather nasty piece of malware that pretends to be our login screen but instead sends your information real-time to the compromiser. Thankfully, this is hard to pull off so these are rare, but it's vital you find it.

Have you downloaded new addons lately - and if so, where did you get them? These are famous for being hidden in supposedly 'good' addons that are downloaded from 'bad' sources, especially if you did a Google search for them and just took the top sponsored links.

I do see your petition here, so your compromise is in queue to be researched for restoration.