League of Legends is becoming an entry point for a new type of romance scam in which suspicious accounts approach players after matches, flirt with them, and attempt to move the conversation to Discord, according to Malwarebytes.
Malwarebytes investigated the activity after receiving a firsthand account describing bots that send friend requests through the Riot client almost immediately after a match ends. Similar encounters have reportedly been discussed by players in gaming communities over recent months, with the interactions following a remarkably consistent pattern.
The approach usually starts with a compliment about the player’s performance. The unfamiliar account may claim to have participated in the previous match, despite its username not appearing among the players involved. Malwarebytes says many of the suspicious profiles have little visible activity, although some may be previously existing accounts that were compromised.
The account typically presents itself as a woman interested in finding someone to play with. After a brief conversation, the supposed player says they are leaving the game and provides a Discord username, shifting the interaction away from Riot’s platform.
According to Malwarebytes, the conversation can then develop into a longer romance or flirtation script. The persona spends time building rapport and sends photographs intended to make the identity appear genuine. Eventually, the target may receive a link to a paid subscription page, often presented as exclusive content.
Malwarebytes found evidence suggesting that the identities used in these conversations are not necessarily genuine. A reverse image search performed on photographs from one interaction found the same pictures on unrelated websites. Other users had reportedly encountered identical images from accounts operating under different names.
The behavior also raised suspicions that AI or automated chat systems are helping operate the accounts. Malwarebytes described an instance where a suspected bot changed the photograph it sent after being ignored, selecting an image that matched the context of its follow-up message. Attempts to make the account reveal its underlying instructions were unsuccessful, and it continued behaving as the same persona.
However, Malwarebytes does not establish that every conversation is handled entirely by AI. The operation could involve scripted automation, AI-generated responses, human chat operators, or a combination of those methods.
The apparent objective in the activity investigated by Malwarebytes was primarily to direct targets toward paid adult-content subscriptions rather than immediately steal money or credentials. The company also noted community reports describing more dangerous variations in which similar conversations eventually lead to credential-stealing pages or attempts to hijack Discord accounts.
What distinguishes the campaign from more familiar online romance scams is where contact begins. Rather than approaching targets through dating services or social media, the accounts use a recent League of Legends match as a reason to initiate a seemingly natural conversation.
Malwarebytes recommends treating unexpected Riot friend requests cautiously, particularly when an unfamiliar account contacts a player immediately after a match and quickly attempts to move the conversation to Discord. Checking whether the person actually participated in the previous game and examining suspicious photographs through reverse image search can help reveal fabricated identities.