Microsoft Corp. has filed a lawsuit alleging a Chinese company illegally accessed Xbox accounts to purchase game currencies using the credit card details of the victims.

The lawsuit, filed in the U.S. District Court Northern District of California and first discovered by Bleeping Computer, alleges that Gameest International Network Sales Co. Ltd., Weiwei Chu and Does 1-20 engaged in international trafficking of Microsoft account credentials and stolen Xbox gaming currencies through a site called iGSKY. The suit doesn’t accuse the defendants of hacking accounts to obtain virtual currencies but of illegally obtaining the credentials of accounts, presumably from third-party hackers.

Microsoft claims in the lawsuit that they became aware of the defendant’s activities from the iGSKY service in late 2016. Because of suspiciously low prices, it “promptly undertook an investigation which included test purchasing virtual gaming currencies from iGSKY. Specifically, from December 5, 2016, to January 2017, Microsoft investigators made a series of six test purchases of Microsoft Accounts with virtual gaming currencies. On each occasion, Defendants sold the investigators access to hijacked MSAs with virtual gaming currencies fraudulently purchased with the authorized MSA holders’ credit cards.”

The list of games from which virtual currencies were being offered for includes ArcheAge, Black Desert, Blade and Soul, CSGO, Dofus, Dofus Touch, FIFA 14, FIFA 15, FIFA 16, FIFA 17, Forza Horizon 3, Grand Theft Auto V, Mabinogi, Madden NFL 17, Maple Story, MU Legend, MU Origin, NBA 2K17, NBA Live Mobile, NHL 17, Pokémon GO, Revelation Online, Riders of Icarus, Rocket League, TERA, Tree of Savior, Trove, Twin Saga and Wildstar.

Stealing in-game currencies was apparently not enough for those behind the scam. Microsoft also claimed that having successfully drained accounts, the people behind iGSKY would then change the credentials on each account and offer them for resale as well.

Putting a figure on the cost of the fraud, Microsoft claims that the defendants were able to “complete nearly $2 million in fraudulent purchases of virtual gaming currencies.” The company has since issued customer refunds or has received chargebacks from the credit card-issuing banks for all of the unauthorized and fraudulent purchases.

While the chances of any of those behind the site being caught are slim, given they are all Chinese citizens based in China according to the lawsuit, Microsoft has already managed to have the site’s PayPal account shut down. However, the site remains online and appears still to be offering its stolen wares.

Image: iGKSY screenshot