An unknown threat actor created malicious game modes for the Dota 2 multiplayer online battle arena (MOBA) video game that could have been exploited to establish backdoor access to players’ systems.

The modes exploited a high-severity flaw in the V8 JavaScript engine tracked as CVE-2021-38003 (CVSS score: 8.8), which was exploited as a zero-day and addressed by Google in October 2021.

“Since V8 was not sandboxed in Dota, the exploit on its own allowed for remote code execution against other Dota players,” Avast researcher Jan Vojtěšek said in a report published last week.